Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    f672ba8bf05715a07351bf661588fcc42a13f814b4b6c3c9ea3519d35861a86f_JC.exe

  • Size

    461KB

  • Sample

    231010-w385zahf77

  • MD5

    9d388a4fd1967964c6aad56cd03ab084

  • SHA1

    5fa3d121998a267301ecafe49e69f97091436488

  • SHA256

    f672ba8bf05715a07351bf661588fcc42a13f814b4b6c3c9ea3519d35861a86f

  • SHA512

    0f12705317ed212e9f94138f901681a34e5181821a9d80f6881331223c13dda1ac63e28e54175af9e86ffc30ce4cc21aabe30b9af686ff1619c7c92f50a6a05b

  • SSDEEP

    12288:vUG+TUnCxfCHyqFVtXusi6Kuf8Dw4dlD4CdMxGp:vUGWUnXyqFVtesH8Dw4dlDv

Malware Config

Extracted

Family

redline

Botnet

unique28.5

C2

194.169.175.232:45451

Targets

    • Target

      f672ba8bf05715a07351bf661588fcc42a13f814b4b6c3c9ea3519d35861a86f_JC.exe

    • Size

      461KB

    • MD5

      9d388a4fd1967964c6aad56cd03ab084

    • SHA1

      5fa3d121998a267301ecafe49e69f97091436488

    • SHA256

      f672ba8bf05715a07351bf661588fcc42a13f814b4b6c3c9ea3519d35861a86f

    • SHA512

      0f12705317ed212e9f94138f901681a34e5181821a9d80f6881331223c13dda1ac63e28e54175af9e86ffc30ce4cc21aabe30b9af686ff1619c7c92f50a6a05b

    • SSDEEP

      12288:vUG+TUnCxfCHyqFVtXusi6Kuf8Dw4dlD4CdMxGp:vUGWUnXyqFVtesH8Dw4dlDv

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks