Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    735b6c9f76a6353543fbbd902d763b4b61b522f0a24df3de20ce7e70ebb8f874

  • Size

    337KB

  • Sample

    230503-esth4afd9v

  • MD5

    f8eb858177aa9334f5dac641740a876d

  • SHA1

    010de59da046fb3d8fc719b195b902f7fc3e5a62

  • SHA256

    735b6c9f76a6353543fbbd902d763b4b61b522f0a24df3de20ce7e70ebb8f874

  • SHA512

    fa113343343fc0a510fd4aadb8d35b2311a889f0abfc5fa170a531df28b56349bc55e7b838cbcd6d48a04ca83ed9c04b16c1181d633aa451f4884d38d6bb1867

  • SSDEEP

    6144:vdEkh2JJtk1HRLOmD6XctJ4jMzn90w6iqhv+TcIzAi:vdEm2JEhRim6MkjxRphvj0

Malware Config

Extracted

Family

redline

C2

135.181.241.192:4328

Attributes
  • auth_value

    a909e2aaecf96137978fea4f86400b9b

Targets

    • Target

      735b6c9f76a6353543fbbd902d763b4b61b522f0a24df3de20ce7e70ebb8f874

    • Size

      337KB

    • MD5

      f8eb858177aa9334f5dac641740a876d

    • SHA1

      010de59da046fb3d8fc719b195b902f7fc3e5a62

    • SHA256

      735b6c9f76a6353543fbbd902d763b4b61b522f0a24df3de20ce7e70ebb8f874

    • SHA512

      fa113343343fc0a510fd4aadb8d35b2311a889f0abfc5fa170a531df28b56349bc55e7b838cbcd6d48a04ca83ed9c04b16c1181d633aa451f4884d38d6bb1867

    • SSDEEP

      6144:vdEkh2JJtk1HRLOmD6XctJ4jMzn90w6iqhv+TcIzAi:vdEm2JEhRim6MkjxRphvj0

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks