Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    0x0003000000000737-189.dat

  • Size

    145KB

  • Sample

    230521-13enksfe3y

  • MD5

    5d186224a0e0d397e9ec9212d90f3b98

  • SHA1

    56bfbc1cc7a745703044bf93b87face9965a48da

  • SHA256

    a4a077cd4a28bd0ee6a4c7ada31e6e946a86df96850830dd80ff8801c8d2b95f

  • SHA512

    a39236fa0f17ffcc1bd2d718cf71417d2f7ae797ab2e240688acf4505dd9e89acc56ace4566d929a5da4a7e8f8ec33f1935c17ff904327dfb2961f787e210497

  • SSDEEP

    1536:o2BGlTP+mZP61sEYDmRSNIgcscLDuRwH77+u8oxQKHbuxGBNM740wuei/Qv+R+Fn:6V+m5cvQmRSN90+82iTi74h9ZF8e8hU

Malware Config

Extracted

Family

redline

Botnet

mixa

C2

185.161.248.37:4138

Attributes
  • auth_value

    9d14534b25ac495ab25b59800acf3bb2

Targets

    • Target

      0x0003000000000737-189.dat

    • Size

      145KB

    • MD5

      5d186224a0e0d397e9ec9212d90f3b98

    • SHA1

      56bfbc1cc7a745703044bf93b87face9965a48da

    • SHA256

      a4a077cd4a28bd0ee6a4c7ada31e6e946a86df96850830dd80ff8801c8d2b95f

    • SHA512

      a39236fa0f17ffcc1bd2d718cf71417d2f7ae797ab2e240688acf4505dd9e89acc56ace4566d929a5da4a7e8f8ec33f1935c17ff904327dfb2961f787e210497

    • SSDEEP

      1536:o2BGlTP+mZP61sEYDmRSNIgcscLDuRwH77+u8oxQKHbuxGBNM740wuei/Qv+R+Fn:6V+m5cvQmRSN90+82iTi74h9ZF8e8hU

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks