Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    0x0003000000000731-2380.dat

  • Size

    168KB

  • Sample

    230415-k3ytfsdf37

  • MD5

    06cdc3551cb6e0e47fdb6210a7f85c97

  • SHA1

    374ea68f6ee6b9430d669ee613286586a7ac2902

  • SHA256

    fac81ab6711219aed7f6c1750c3b5d5713eed4903bbd4dc10d248f627c27a10c

  • SHA512

    8dbded30f3a74bc801e13e4d6591e181161c811c4879fdf091eb2570e74078c66ba86b371ab60192d528f40dc3a6cf5a872a091826e686b66f0f4dd444134d2b

  • SSDEEP

    1536:jtHYp2QPnEqlVZRGWV50r1hJ2/xwMx9CgKKKKKKKKKKKKKKKKKKKKKKKOKKKKKK5:jto2Qf3qhUZvx9YqVEF9HIieJ98e8hQ

Malware Config

Extracted

Family

redline

Botnet

mars

C2

77.91.124.146:4121

Attributes
  • auth_value

    1c0fd23750a42192aed327b088c4f852

Targets

    • Target

      0x0003000000000731-2380.dat

    • Size

      168KB

    • MD5

      06cdc3551cb6e0e47fdb6210a7f85c97

    • SHA1

      374ea68f6ee6b9430d669ee613286586a7ac2902

    • SHA256

      fac81ab6711219aed7f6c1750c3b5d5713eed4903bbd4dc10d248f627c27a10c

    • SHA512

      8dbded30f3a74bc801e13e4d6591e181161c811c4879fdf091eb2570e74078c66ba86b371ab60192d528f40dc3a6cf5a872a091826e686b66f0f4dd444134d2b

    • SSDEEP

      1536:jtHYp2QPnEqlVZRGWV50r1hJ2/xwMx9CgKKKKKKKKKKKKKKKKKKKKKKKOKKKKKK5:jto2Qf3qhUZvx9YqVEF9HIieJ98e8hQ

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks