Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    b99b1a85c13a81e58ffdc7889779942bb4dba38dd89ce3c5b347b5e3886c5c62

  • Size

    364KB

  • Sample

    220926-k8fj3aacc4

  • MD5

    d5c3210f4bf167a31305ea3cf399594b

  • SHA1

    0d5b6556284981548cdf2b742c2046dcc550235f

  • SHA256

    b99b1a85c13a81e58ffdc7889779942bb4dba38dd89ce3c5b347b5e3886c5c62

  • SHA512

    0783252836e065ce00b6eb62aa526f2c4c5b6c0169b04d33f6a15fcd8b7dc260430d30f82f9b1f6289bb002ac021add4ec1c8221284181e828343d537b73052d

  • SSDEEP

    6144:eEaXBUcN2BRrn1fH0N6GkBut5adsSEK69yDPhSjYlakxjTLVqoARRSTZAPdg+:/aRDNoVJKRtUdsSEK69yDPhSjYlakxjv

Malware Config

Extracted

Family

redline

Botnet

0002

C2

13.72.81.58:13413

Attributes
  • auth_value

    866ce0ed8cfe2be77fb43a4912677698

Targets

    • Target

      b99b1a85c13a81e58ffdc7889779942bb4dba38dd89ce3c5b347b5e3886c5c62

    • Size

      364KB

    • MD5

      d5c3210f4bf167a31305ea3cf399594b

    • SHA1

      0d5b6556284981548cdf2b742c2046dcc550235f

    • SHA256

      b99b1a85c13a81e58ffdc7889779942bb4dba38dd89ce3c5b347b5e3886c5c62

    • SHA512

      0783252836e065ce00b6eb62aa526f2c4c5b6c0169b04d33f6a15fcd8b7dc260430d30f82f9b1f6289bb002ac021add4ec1c8221284181e828343d537b73052d

    • SSDEEP

      6144:eEaXBUcN2BRrn1fH0N6GkBut5adsSEK69yDPhSjYlakxjTLVqoARRSTZAPdg+:/aRDNoVJKRtUdsSEK69yDPhSjYlakxjv

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks