Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    f13b278976ed4a4a2cd0c782bc76a2597d358a79c6e7f998b7c95ee21bb206ae

  • Size

    138KB

  • Sample

    221203-zzb8lsef55

  • MD5

    3a65d5ee4d0c15d3f7902ca3e2c3a447

  • SHA1

    7c4fd72a146b5c13f12d69f30a552f3c9e7ed7e7

  • SHA256

    edad9ea1c7527d8375a81b5a63f2defeb42633771a2244b7f042881ed295cb06

  • SHA512

    92e820090fc4203d49447c1b069a33ea1832a191e968805b7e9b2ffd2f530609a797317c0f10b237d41c5b600967a3229bff8f9217417a2f7ce49f15e9a50814

  • SSDEEP

    3072:Y7bXhBYcK+ZEpeaOBQ1F94wujHvDD3ofCQYHxJxP3IAV6Lx/gH0zj9T37:Y/HYcdZnaVD94rjHLUfCQgmA41rzj9Tr

Score
10/10

Malware Config

Extracted

Family

redline

Botnet

@P1

C2

193.106.191.138:32796

Attributes
  • auth_value

    54c79ce081122137049ee07c0a2f38ab

Targets

    • Target

      f13b278976ed4a4a2cd0c782bc76a2597d358a79c6e7f998b7c95ee21bb206ae

    • Size

      217KB

    • MD5

      883749fce20bc27382131894e7f9451d

    • SHA1

      61015691b274bf7f9cc2592d372c11d38219c325

    • SHA256

      f13b278976ed4a4a2cd0c782bc76a2597d358a79c6e7f998b7c95ee21bb206ae

    • SHA512

      d8a3bbdfdb5adf2c67bb1b38d2d05a86ee2aa3caee60fc4af5c256afd11ce8609556e3d7ce50593d933a7d9f3b0aabdfb90a6e3fdcbb101a538404e57dc00230

    • SSDEEP

      3072:cliRSiFzW0qu7b4ee8fwmGzPMWxS+bsqLCX3knb95IcWdXCY9bTAIrFldI0cBxO:cliRSwNveMwTDM4RVCkbSCY9fSC

    Score
    10/10
    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Uses the VBS compiler for execution

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks