Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    75c33be0a58a119e5bddd4a80d0caa7ac93e487676dbf2a52551ca611ce97edf

  • Size

    2.4MB

  • Sample

    221101-l12b8sbecn

  • MD5

    7f42dae2237390f9fc3314f7a1ab2dd0

  • SHA1

    68ca8d2cd7dbf9992ab84c249bfaca6eeae8fa14

  • SHA256

    75c33be0a58a119e5bddd4a80d0caa7ac93e487676dbf2a52551ca611ce97edf

  • SHA512

    406842e2d7a72b88c4c2eca97a93e460d0d332e52d46e4dbbf485f24ba16140be8ed4da5467056b1716dcf26c999233f6fbb258c64f0c539ac9040d247089a3c

  • SSDEEP

    24576:2GGi2ywj4YfY9NqbBSMQKl02M2wdBhe+jvcoWvwiGmLLSmjl3RuQ55313m:2Z9G5BtLqvwiGmL1l3o

Malware Config

Extracted

Family

redline

C2

185.106.92.8:38644

Attributes
  • auth_value

    2f5ccfa29fc95c14f0fd0a827b7b24ee

Targets

    • Target

      75c33be0a58a119e5bddd4a80d0caa7ac93e487676dbf2a52551ca611ce97edf

    • Size

      2.4MB

    • MD5

      7f42dae2237390f9fc3314f7a1ab2dd0

    • SHA1

      68ca8d2cd7dbf9992ab84c249bfaca6eeae8fa14

    • SHA256

      75c33be0a58a119e5bddd4a80d0caa7ac93e487676dbf2a52551ca611ce97edf

    • SHA512

      406842e2d7a72b88c4c2eca97a93e460d0d332e52d46e4dbbf485f24ba16140be8ed4da5467056b1716dcf26c999233f6fbb258c64f0c539ac9040d247089a3c

    • SSDEEP

      24576:2GGi2ywj4YfY9NqbBSMQKl02M2wdBhe+jvcoWvwiGmLLSmjl3RuQ55313m:2Z9G5BtLqvwiGmL1l3o

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks