Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    1212-61-0x0000000000980000-0x00000000009A8000-memory.dmp

  • Size

    160KB

  • Sample

    221010-rvg93acbf3

  • MD5

    2c9b1ec7ec2a3e62db810608dba5bba2

  • SHA1

    3e2217a7e354dd0191616830c3ff84a5a101a021

  • SHA256

    bda4f827ed1606b5f92d3c63fa7218c5f40a669e7e2d367ec08616dbf5218e6f

  • SHA512

    da006c1b47b33f857615d6ecea0e4be7d65bd85f0ef28c1a368787bc741e1b3071491565c6cb5a6dcba9af5ec0f74725ea2f74f92a663a2c2152e438aa3b64d7

  • SSDEEP

    3072:3YO/ZMTF1BEowLkeheZd+OPEXVLDFFYRX5hYSSUB:3YMZMB1BEo7Zd+Os5EB5h

Malware Config

Extracted

Family

redline

Botnet

101022_2

C2

root.firstmillion.click:81

Attributes
  • auth_value

    bc652e9ce9050ad62ce617ca5ed09885

Targets

    • Target

      1212-61-0x0000000000980000-0x00000000009A8000-memory.dmp

    • Size

      160KB

    • MD5

      2c9b1ec7ec2a3e62db810608dba5bba2

    • SHA1

      3e2217a7e354dd0191616830c3ff84a5a101a021

    • SHA256

      bda4f827ed1606b5f92d3c63fa7218c5f40a669e7e2d367ec08616dbf5218e6f

    • SHA512

      da006c1b47b33f857615d6ecea0e4be7d65bd85f0ef28c1a368787bc741e1b3071491565c6cb5a6dcba9af5ec0f74725ea2f74f92a663a2c2152e438aa3b64d7

    • SSDEEP

      3072:3YO/ZMTF1BEowLkeheZd+OPEXVLDFFYRX5hYSSUB:3YMZMB1BEo7Zd+Os5EB5h

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks