Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    0x000200000001aefc-194.dat

  • Size

    168KB

  • Sample

    230504-l8pcmsdd4x

  • MD5

    64926c6104571db35d1b68c3a19b8a15

  • SHA1

    2857daee544a9df86c5890d68819cf9482def045

  • SHA256

    eae12bbc9ced2272c20e9ebd8cd2401f13c8ee38e5854dbeff3efffcf538a19b

  • SHA512

    0ad290429a01325f61fb793a94d6cc8b3c00da181b8bba1daaa7e89243286ddb006fd19ac3a6cf6fa841ef6b37bc2b91bfcbc5e2cd2d7a9b358e750cfbeb35f4

  • SSDEEP

    3072:ny05zK3/zb9txdeqVOyAWdTKVee8e8hv:ny05zM/f9YUdTKVee

Malware Config

Extracted

Family

redline

Botnet

mask

C2

217.196.96.56:4138

Attributes
  • auth_value

    31aef25be0febb8e491794ef7f502c50

Targets

    • Target

      0x000200000001aefc-194.dat

    • Size

      168KB

    • MD5

      64926c6104571db35d1b68c3a19b8a15

    • SHA1

      2857daee544a9df86c5890d68819cf9482def045

    • SHA256

      eae12bbc9ced2272c20e9ebd8cd2401f13c8ee38e5854dbeff3efffcf538a19b

    • SHA512

      0ad290429a01325f61fb793a94d6cc8b3c00da181b8bba1daaa7e89243286ddb006fd19ac3a6cf6fa841ef6b37bc2b91bfcbc5e2cd2d7a9b358e750cfbeb35f4

    • SSDEEP

      3072:ny05zK3/zb9txdeqVOyAWdTKVee8e8hv:ny05zM/f9YUdTKVee

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks