Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    a9835342545dccc28b6477fca9416b37258ccaee343e75d1ef828a66e120df6b

  • Size

    1.1MB

  • Sample

    231002-x1639sfg42

  • MD5

    ab731e7d8e334afc7db4eb1a39e2e0a9

  • SHA1

    78ab5a0c98af58f132f0da58cec8774b4778418c

  • SHA256

    a9835342545dccc28b6477fca9416b37258ccaee343e75d1ef828a66e120df6b

  • SHA512

    8946c23fa8da79fb08b05b5eea221efca7743ee04bb183a740fa3a0a73fbe9235f0527f3c52cb4efb9a2f66cf975d59c58edb51a743060218b0fe7c014ec4379

  • SSDEEP

    24576:Hyf/Y8iDZJTIPoLboRsmX18izZGsvGompPf:Sf/Y8iDjIQS18izZGsvG3P

Malware Config

Extracted

Family

redline

Botnet

larek

C2

77.91.124.55:19071

Targets

    • Target

      a9835342545dccc28b6477fca9416b37258ccaee343e75d1ef828a66e120df6b

    • Size

      1.1MB

    • MD5

      ab731e7d8e334afc7db4eb1a39e2e0a9

    • SHA1

      78ab5a0c98af58f132f0da58cec8774b4778418c

    • SHA256

      a9835342545dccc28b6477fca9416b37258ccaee343e75d1ef828a66e120df6b

    • SHA512

      8946c23fa8da79fb08b05b5eea221efca7743ee04bb183a740fa3a0a73fbe9235f0527f3c52cb4efb9a2f66cf975d59c58edb51a743060218b0fe7c014ec4379

    • SSDEEP

      24576:Hyf/Y8iDZJTIPoLboRsmX18izZGsvGompPf:Sf/Y8iDjIQS18izZGsvG3P

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Executes dropped EXE

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks