Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    1787a1fa6e7758008391e962b6911100817801e799b4752c50879de555b5e736

  • Size

    1.1MB

  • Sample

    231011-h3t46ahc7s

  • MD5

    c950b18ebc6ae5c21fecb0636a2c8dc9

  • SHA1

    cdda4b3641169d68c3aa43ba69b81c0bf39ddd74

  • SHA256

    1787a1fa6e7758008391e962b6911100817801e799b4752c50879de555b5e736

  • SHA512

    1b7a40f3c941f5aad8b23fcc5dd11a839bd7f47218702ff7c7dd5154fbfbf5a2d2430ef22daff3728fca9260ccccbdd3e53e38cd3952fdaf39f8bd14e9b4d16f

  • SSDEEP

    24576:Vy1CjMtIxQaliYA3hyJlsgdt7FA8BtScx:w1qMi2HTim4tS8

Malware Config

Extracted

Family

redline

Botnet

luska

C2

77.91.124.55:19071

Attributes
  • auth_value

    a6797888f51a88afbfd8854a79ac9357

Targets

    • Target

      1787a1fa6e7758008391e962b6911100817801e799b4752c50879de555b5e736

    • Size

      1.1MB

    • MD5

      c950b18ebc6ae5c21fecb0636a2c8dc9

    • SHA1

      cdda4b3641169d68c3aa43ba69b81c0bf39ddd74

    • SHA256

      1787a1fa6e7758008391e962b6911100817801e799b4752c50879de555b5e736

    • SHA512

      1b7a40f3c941f5aad8b23fcc5dd11a839bd7f47218702ff7c7dd5154fbfbf5a2d2430ef22daff3728fca9260ccccbdd3e53e38cd3952fdaf39f8bd14e9b4d16f

    • SSDEEP

      24576:Vy1CjMtIxQaliYA3hyJlsgdt7FA8BtScx:w1qMi2HTim4tS8

    • Detect Mystic stealer payload

    • Mystic

      Mystic is an infostealer written in C++.

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks