Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    tmp

  • Size

    137KB

  • Sample

    221028-1cf4qagdhr

  • MD5

    14e5359992d0a3f4c66f51766a70ad26

  • SHA1

    274a8bbf8197f1a803215b95fc3879785924dcb4

  • SHA256

    747329e17b67401944bd3f8a11b4cbe8770ad714eda50740ef1629431c713e3b

  • SHA512

    1d120ea2cfb5743a46d9c17e1530a2f5de7d0fd61e8a3d0ad933c5b966da83271af92adfa5c8ba038206d686bb661965d6dc2b862d8f10098900dd6e78c36a26

  • SSDEEP

    3072:MYO/ZMTFhne4tHu2yu/Sx7ZIVaDF2bRP8hPSSP4:MYMZMBhne4A2//Sx7ZN0p8h

Malware Config

Extracted

Family

redline

Botnet

seo35

C2

34.92.152.18:27180

Attributes
  • auth_value

    402c199e97a51d0d3197786424b45812

Targets

    • Target

      tmp

    • Size

      137KB

    • MD5

      14e5359992d0a3f4c66f51766a70ad26

    • SHA1

      274a8bbf8197f1a803215b95fc3879785924dcb4

    • SHA256

      747329e17b67401944bd3f8a11b4cbe8770ad714eda50740ef1629431c713e3b

    • SHA512

      1d120ea2cfb5743a46d9c17e1530a2f5de7d0fd61e8a3d0ad933c5b966da83271af92adfa5c8ba038206d686bb661965d6dc2b862d8f10098900dd6e78c36a26

    • SSDEEP

      3072:MYO/ZMTFhne4tHu2yu/Sx7ZIVaDF2bRP8hPSSP4:MYMZMBhne4A2//Sx7ZN0p8h

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks