Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    29fdb67c6514ccd0a7450c9e0733c2149f45c9bfc6ad604a3177de5d1abce813

  • Size

    278KB

  • Sample

    230101-apj32aah72

  • MD5

    7d0670034f4b78009d8204d917fe4534

  • SHA1

    831e20631a78ba5e46e0fc70fb2a1c8bc28fdd7a

  • SHA256

    b0b36d37c9d68abac0d536b284b6763b6053f2cf8b848cd4ece5135c2e77068b

  • SHA512

    41b894fe04b353b2f8e52f40b48a98985b85797363510a4491d53ad8d7f6b4b6d2056844a3e7709aaf2158e8d0fabdce67c63381433b3838b876b2333c52c195

  • SSDEEP

    6144:smov/NbNoD4thrm2wy9LsqLGicqja/KAJrUTln9Z:dovZesfrm2wy9LJ6iOKAJrUpn9Z

Malware Config

Extracted

Family

redline

Botnet

sport

C2

31.41.244.98:4063

Attributes
  • auth_value

    82cce55eeb56b322651e98032c09d225

Targets

    • Target

      29fdb67c6514ccd0a7450c9e0733c2149f45c9bfc6ad604a3177de5d1abce813

    • Size

      381KB

    • MD5

      7b0f625443114e1bc8e226ec6030ad18

    • SHA1

      90a4a6a971c7f53dfd36fbc75a9d700a1108c600

    • SHA256

      29fdb67c6514ccd0a7450c9e0733c2149f45c9bfc6ad604a3177de5d1abce813

    • SHA512

      c44849d42f9f8283544c9ca057d3f315a941797d92e7071903e145c05333d3a4b464f9de142e2f4005a13824b9b087ebae1a96648c3fe605d89552400839cc36

    • SSDEEP

      6144:jj4L+pHeQ7CvEBhrU2Wy9L2qLGicgP1R+JPbCWZY:X46p+Q7IELrU2Wy9LH6izNg

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks