Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    dfb581d475410d56964d612b27deed04.bin

  • Size

    127KB

  • Sample

    230616-cc6sdacd42

  • MD5

    3db021b2ed16c5f7de0bf6896aa6e26d

  • SHA1

    3ebc0a89ba4b0b6fdade84375f26f91daa5bb0da

  • SHA256

    f09665ab0cfa25f17308b3de4009b8198453a6f734280b2def521b5d9bc34e34

  • SHA512

    ebd32d3281393788ec92980241017fae42207a0b5d4d64593bffe9ae268e88b0ca96f96c773d58a388ee9af36313a26b0d373c64c0cdacf407878fc7c1db6433

  • SSDEEP

    3072:sa1xj2g1AM8jRl+tyFK+65pn9/dDI71MRmZAcXLE/p:dlHgRRKFPn9a7AkFQ/p

Malware Config

Extracted

Family

redline

Botnet

lux3

C2

176.123.9.142:14845

Attributes
  • auth_value

    e94dff9a76da90d6b000642c4a52574b

Targets

    • Target

      3c979ae1af88397dc5be34fea28050d85cd283898d71e52c8ad1db05c407458b.exe

    • Size

      282KB

    • MD5

      dfb581d475410d56964d612b27deed04

    • SHA1

      7b442cbb69901dd4b1d8fd00334fded04ee3bfdc

    • SHA256

      3c979ae1af88397dc5be34fea28050d85cd283898d71e52c8ad1db05c407458b

    • SHA512

      1580cec72d005a03eb42cf54d865b0ee1c70bb707a72c64c093818826667bc289bf8404dc3336b0fba37a80401b0a0ff38b7036e762a84c038dfdb3ec5c7074f

    • SSDEEP

      3072:hfeKl8OErmZvy0j90YQB3IxgcDCJi8vc7rUh+28YZvt97k/pBxe:hfhl3Ermj90Ya3EdDCsmck4rSG/g

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks