Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    2be841abb5bed075610bd834943cd416be724e9407aa024101cb83181535247d

  • Size

    566KB

  • Sample

    230506-zyrlxaef34

  • MD5

    a9488b7cba13ca1cb06b9dd207d49abd

  • SHA1

    7b37b225d46db8edd606eeec38e769bbf5ceefa3

  • SHA256

    2be841abb5bed075610bd834943cd416be724e9407aa024101cb83181535247d

  • SHA512

    c8c88b0929f129162d4fb84ae2453b8333594ca7b21fbe61623b08e70ccb02298ac962d471a7e3d8186bfa3dc676de1ae6449b1913d4af9dc92905d9f857b2b4

  • SSDEEP

    12288:UMrRy90Y3zdweL2bmcEoaZJcPua9FZwmMYTsL6auz7895Z0ODm:lyv3JPBFQ1TZXTZau09o2m

Malware Config

Extracted

Family

redline

Botnet

darm

C2

217.196.96.56:4138

Attributes
  • auth_value

    d88ac8ccc04ab9979b04b46313db1648

Targets

    • Target

      2be841abb5bed075610bd834943cd416be724e9407aa024101cb83181535247d

    • Size

      566KB

    • MD5

      a9488b7cba13ca1cb06b9dd207d49abd

    • SHA1

      7b37b225d46db8edd606eeec38e769bbf5ceefa3

    • SHA256

      2be841abb5bed075610bd834943cd416be724e9407aa024101cb83181535247d

    • SHA512

      c8c88b0929f129162d4fb84ae2453b8333594ca7b21fbe61623b08e70ccb02298ac962d471a7e3d8186bfa3dc676de1ae6449b1913d4af9dc92905d9f857b2b4

    • SSDEEP

      12288:UMrRy90Y3zdweL2bmcEoaZJcPua9FZwmMYTsL6auz7895Z0ODm:lyv3JPBFQ1TZXTZau09o2m

    • Detects Redline Stealer samples

      This rule detects the presence of Redline Stealer samples based on their unique strings.

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

MITRE ATT&CK Enterprise v6

Tasks