Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    613f058b34419fa46aaf71c61ec0afe963c133e023b6f75d889fb67395ddaf1b

  • Size

    1.0MB

  • Sample

    231011-lahr7sde3t

  • MD5

    4e3304bd81a45a4a02d298dc508194c0

  • SHA1

    b09d6899f03e48da77fee9e905741793064e116e

  • SHA256

    613f058b34419fa46aaf71c61ec0afe963c133e023b6f75d889fb67395ddaf1b

  • SHA512

    eecf0d026900af4157ec4f53428dd9af54ee29ca10187d08e9227f64265d6ac4c86a85bcb54bdc4f301d9ee8d842711db36653225c30a188073ed655ad44a901

  • SSDEEP

    24576:YM573oyJAzoy99wIqjQfgia8gzhkxsWSPjmJRGYPVs:YM573oyy99wICQB22x/m

Malware Config

Extracted

Family

redline

Botnet

unique285

C2

194.169.175.232:45451

Attributes
  • auth_value

    1ed06994a9a19d3729019cb69c1f61a6

Targets

    • Target

      613f058b34419fa46aaf71c61ec0afe963c133e023b6f75d889fb67395ddaf1b

    • Size

      1.0MB

    • MD5

      4e3304bd81a45a4a02d298dc508194c0

    • SHA1

      b09d6899f03e48da77fee9e905741793064e116e

    • SHA256

      613f058b34419fa46aaf71c61ec0afe963c133e023b6f75d889fb67395ddaf1b

    • SHA512

      eecf0d026900af4157ec4f53428dd9af54ee29ca10187d08e9227f64265d6ac4c86a85bcb54bdc4f301d9ee8d842711db36653225c30a188073ed655ad44a901

    • SSDEEP

      24576:YM573oyJAzoy99wIqjQfgia8gzhkxsWSPjmJRGYPVs:YM573oyy99wICQB22x/m

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • Uses the VBS compiler for execution

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks