Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    068514f5a92707c86c3494f9868f898c.exe

  • Size

    2.5MB

  • Sample

    221009-zapseahgc6

  • MD5

    068514f5a92707c86c3494f9868f898c

  • SHA1

    946971adbbea34eb91f91e1d593bb97b2d63fa11

  • SHA256

    7355dd57286957e0aac341c5b8483dd2dc7fb6d6e8f1704e9386efe30ede751c

  • SHA512

    2bbe00afcc47a8d40c1ca87383c3fb4f9159861e75fa9e04dad12d953dd3d8a0a5c5a43aa6c8582af4ce3eeef4ab79976e30233e597cbd0acb40a558a1f98b32

  • SSDEEP

    24576:KBIgYBHadgaFPaDYVYp41jlDSM5ldgalC8j+2CxGI6L/nLz1l3RuQ55313X:gInB6dgaFP40xq/xt6L/n31l3N

Malware Config

Extracted

Family

redline

Botnet

5744794367_99

C2

zaraat.xyz:37397

Attributes
  • auth_value

    3a48ab7a0fb74109c7045f72b67b61e0

Targets

    • Target

      068514f5a92707c86c3494f9868f898c.exe

    • Size

      2.5MB

    • MD5

      068514f5a92707c86c3494f9868f898c

    • SHA1

      946971adbbea34eb91f91e1d593bb97b2d63fa11

    • SHA256

      7355dd57286957e0aac341c5b8483dd2dc7fb6d6e8f1704e9386efe30ede751c

    • SHA512

      2bbe00afcc47a8d40c1ca87383c3fb4f9159861e75fa9e04dad12d953dd3d8a0a5c5a43aa6c8582af4ce3eeef4ab79976e30233e597cbd0acb40a558a1f98b32

    • SSDEEP

      24576:KBIgYBHadgaFPaDYVYp41jlDSM5ldgalC8j+2CxGI6L/nLz1l3RuQ55313X:gInB6dgaFP40xq/xt6L/n31l3N

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks