Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    cf5dc3913f2f94ab10322a52f62d999b2824ab5fb070cbbb75af7d5e4ac2c01b

  • Size

    262KB

  • Sample

    230607-pkmqpaac88

  • MD5

    845040e5441f80a161fed05213426cf5

  • SHA1

    2466b1119f6c024f6d856d5b98a0431a5597f6b8

  • SHA256

    cf5dc3913f2f94ab10322a52f62d999b2824ab5fb070cbbb75af7d5e4ac2c01b

  • SHA512

    8cb11b3a91747a0d4a2433579098f5cb947aedd0d3ced4475d761631705dc541435c951bb8c79e6fa1a47d6226dc95b137d1ca6963c873cc16ad62ac7022ae6d

  • SSDEEP

    3072:Ox/qx1OuyRyXFaQ7RQ05CTEezbClXv8r8+oFe6gobFHFzA+E+2SUHcj/:a/qx1aEFaQ7W05AEezbMPZFzAy2Sc

Malware Config

Extracted

Family

redline

Botnet

sheron

C2

83.97.73.129:19068

Attributes
  • auth_value

    2d067e7e2372227d3a03b335260112e9

Targets

    • Target

      cf5dc3913f2f94ab10322a52f62d999b2824ab5fb070cbbb75af7d5e4ac2c01b

    • Size

      262KB

    • MD5

      845040e5441f80a161fed05213426cf5

    • SHA1

      2466b1119f6c024f6d856d5b98a0431a5597f6b8

    • SHA256

      cf5dc3913f2f94ab10322a52f62d999b2824ab5fb070cbbb75af7d5e4ac2c01b

    • SHA512

      8cb11b3a91747a0d4a2433579098f5cb947aedd0d3ced4475d761631705dc541435c951bb8c79e6fa1a47d6226dc95b137d1ca6963c873cc16ad62ac7022ae6d

    • SSDEEP

      3072:Ox/qx1OuyRyXFaQ7RQ05CTEezbClXv8r8+oFe6gobFHFzA+E+2SUHcj/:a/qx1aEFaQ7W05AEezbMPZFzAy2Sc

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks