Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    e65e1432b5b1d09d9314276b3cabd515fe2cba2516251f5379bc10b77cdaee30

  • Size

    262KB

  • Sample

    221219-g8hsmshd5y

  • MD5

    74ea7089c52fba5cb030a139694a68b0

  • SHA1

    80617ddd41815c1b595eac15a98c935f5be0542d

  • SHA256

    a8c52a570a5e8e7350dfa32ae6c5efe51843cf3ab2d219a760b214692ac1831e

  • SHA512

    c71b37594377e778b9e3052769ca1195cbddbb89ebb6efcda9689e2b6da71f887bca603085627a9e12945f8148ba29c24ab085281e06535d7151968a1b73b844

  • SSDEEP

    6144:clydvqNUsb+ctR8sH8YB0nnz5WgyPdQs0c/7kQ88hJ:uKUrkscDnzI1esxoN8hJ

Malware Config

Extracted

Family

redline

Botnet

@2023@New

C2

91.215.85.155:32796

Attributes
  • auth_value

    0be5b9b84cd5b707e91a48e341e3f7d7

Targets

    • Target

      e65e1432b5b1d09d9314276b3cabd515fe2cba2516251f5379bc10b77cdaee30

    • Size

      334KB

    • MD5

      7cac24c7ec05952c47fe380bfa55f7f5

    • SHA1

      22187aab75d669a00470024939666b6ae9ea8c51

    • SHA256

      e65e1432b5b1d09d9314276b3cabd515fe2cba2516251f5379bc10b77cdaee30

    • SHA512

      cde1653c12046b75722771c284cbd365a75fcae88695643caf9dc7f006e6a3aa80ebea39d022de44b543bfd94539334bc87b56d34dab3382aeb432dd8c6de77d

    • SSDEEP

      6144:gvKL2RfudvMNUEb+ctR8sHOYB0nnz5QgyPdQs0cxs+KRsUgNDjlVklPH:aKSwShksuDnzm1esxCDRgNPlU

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks