Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    0x000900000001230c-1037.dat

  • Size

    175KB

  • Sample

    230327-c2x7jadc8t

  • MD5

    0596fc839ec43e12f42258b1f56f0356

  • SHA1

    ed331a7745c14dc5791fc62cb3c3d6499976e850

  • SHA256

    9db73bac85af3c7a5679b5d8c18cbb42b321e3846e5d47f7f8079eb766f900ef

  • SHA512

    be899677fa2d2caaf94bfbf15f5f9a97ffcb1bf6e55433b3d5824f65ffba34b120aaeac620b7a7ce9e27256972914b036d3ef7a93e78cf041358e776abcc68d9

  • SSDEEP

    3072:s9xqZWBJaHEDgXp5lCe159Eh4bxNn2pU9f2MKTV/wi4lr55R9TxlnsPsUw0jOuwY:sHqZV7ljEh

Malware Config

Extracted

Family

redline

Botnet

dent

C2

193.233.20.33:4125

Attributes
  • auth_value

    e795368557f02e28e8aef6bcb279a3b0

Targets

    • Target

      0x000900000001230c-1037.dat

    • Size

      175KB

    • MD5

      0596fc839ec43e12f42258b1f56f0356

    • SHA1

      ed331a7745c14dc5791fc62cb3c3d6499976e850

    • SHA256

      9db73bac85af3c7a5679b5d8c18cbb42b321e3846e5d47f7f8079eb766f900ef

    • SHA512

      be899677fa2d2caaf94bfbf15f5f9a97ffcb1bf6e55433b3d5824f65ffba34b120aaeac620b7a7ce9e27256972914b036d3ef7a93e78cf041358e776abcc68d9

    • SSDEEP

      3072:s9xqZWBJaHEDgXp5lCe159Eh4bxNn2pU9f2MKTV/wi4lr55R9TxlnsPsUw0jOuwY:sHqZV7ljEh

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks