Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    239a2fef8b1b61bb21db547f05620ee337dd0032e22ed4024ddaf9d9eb810dcf

  • Size

    404KB

  • Sample

    230720-sxmg8shh5w

  • MD5

    0db58c6b9873e5809d667688652bafb1

  • SHA1

    6efc3eb9bf947f9b86472978dcf067bddfc41e04

  • SHA256

    239a2fef8b1b61bb21db547f05620ee337dd0032e22ed4024ddaf9d9eb810dcf

  • SHA512

    640e29b1b9c9e1302a5f82197cd0bd48f0dd7b583986abe92184d85bf37f01d391965933e972138c7c619ae16f0748be8b3349c64875a12708f9b7453bce94d8

  • SSDEEP

    6144:JnLOzSOHVgx1fg+SbOKsgRATR8uQtlVW4FK7o/MS:lCOO107SSRTdU147zS

Malware Config

Extracted

Family

redline

Botnet

@Germany

C2

194.26.135.162:2920

Attributes
  • auth_value

    9d15d78194367a949e54a07d6ce02c62

Targets

    • Target

      239a2fef8b1b61bb21db547f05620ee337dd0032e22ed4024ddaf9d9eb810dcf

    • Size

      404KB

    • MD5

      0db58c6b9873e5809d667688652bafb1

    • SHA1

      6efc3eb9bf947f9b86472978dcf067bddfc41e04

    • SHA256

      239a2fef8b1b61bb21db547f05620ee337dd0032e22ed4024ddaf9d9eb810dcf

    • SHA512

      640e29b1b9c9e1302a5f82197cd0bd48f0dd7b583986abe92184d85bf37f01d391965933e972138c7c619ae16f0748be8b3349c64875a12708f9b7453bce94d8

    • SSDEEP

      6144:JnLOzSOHVgx1fg+SbOKsgRATR8uQtlVW4FK7o/MS:lCOO107SSRTdU147zS

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v15

Tasks