Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    i1375719.exe

  • Size

    903KB

  • Sample

    230512-fjgzdaea8y

  • MD5

    aa8cb035ddd861354602c9ee5f2565eb

  • SHA1

    31cb1f67f650c0c9af0b2fbfd6615ca5ca735730

  • SHA256

    8fd5111a22c7ace9c51654e70738642eb5806c0e3e4a35b9a534f2e410fef1a7

  • SHA512

    d2fc82aa3487f5aca586ea9910a0c30d7e8da49a98f3adbc7ba530c5bd2a7d84475f577d524118291b52f73153deeacd99c7f90312a7bc6cc47c3b6ebfa4257e

  • SSDEEP

    12288:sIKrYIWFVRlhENHEPkexLsIdMp1G8Im4LF3LxGlQzDS8Ug1UDy+g3vVohn/TzM04:sI2Y7p3kelqo8oP33

Malware Config

Extracted

Family

redline

Botnet

roza

C2

185.161.248.75:4132

Attributes
  • auth_value

    3e701c8c522386806a8f1f40a90873a7

Targets

    • Target

      i1375719.exe

    • Size

      903KB

    • MD5

      aa8cb035ddd861354602c9ee5f2565eb

    • SHA1

      31cb1f67f650c0c9af0b2fbfd6615ca5ca735730

    • SHA256

      8fd5111a22c7ace9c51654e70738642eb5806c0e3e4a35b9a534f2e410fef1a7

    • SHA512

      d2fc82aa3487f5aca586ea9910a0c30d7e8da49a98f3adbc7ba530c5bd2a7d84475f577d524118291b52f73153deeacd99c7f90312a7bc6cc47c3b6ebfa4257e

    • SSDEEP

      12288:sIKrYIWFVRlhENHEPkexLsIdMp1G8Im4LF3LxGlQzDS8Ug1UDy+g3vVohn/TzM04:sI2Y7p3kelqo8oP33

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks