Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    file.exe

  • Size

    444KB

  • Sample

    230106-f7pzwsec99

  • MD5

    ab5812027899dce080507f3dba2c9589

  • SHA1

    ee5b661243f4932d2e56c5c2e359259306b46f18

  • SHA256

    d7a50adf0a325143997529545a82e03451042578a6e09a5b514a90a25ea0aa35

  • SHA512

    07cb4b9eb71166fb83a34ec98afa1af922b31cf9c7edaa00ca7036580c8117cf122e6fe6dac4128408f1908040f1b34277d7a427656cf97a3bfca5a481f15a1c

  • SSDEEP

    12288:485qx2nHZJGTVMshuTBaOr4m36hKbEvZTbo:4SiwTS7M48RbEvlb

Malware Config

Extracted

Family

redline

Botnet

@new@2023

C2

77.73.133.62:22344

Attributes
  • auth_value

    8284279aedaed026a9b7cb9c1c0be4e4

Targets

    • Target

      file.exe

    • Size

      444KB

    • MD5

      ab5812027899dce080507f3dba2c9589

    • SHA1

      ee5b661243f4932d2e56c5c2e359259306b46f18

    • SHA256

      d7a50adf0a325143997529545a82e03451042578a6e09a5b514a90a25ea0aa35

    • SHA512

      07cb4b9eb71166fb83a34ec98afa1af922b31cf9c7edaa00ca7036580c8117cf122e6fe6dac4128408f1908040f1b34277d7a427656cf97a3bfca5a481f15a1c

    • SSDEEP

      12288:485qx2nHZJGTVMshuTBaOr4m36hKbEvZTbo:4SiwTS7M48RbEvlb

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks