Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    ca4657dc6bccaa562f4209ccb37e5fddad1f2b60deef223031f752e4f486a106

  • Size

    929KB

  • Sample

    231011-xdyhlseh6t

  • MD5

    07a3992da323757a1f477b4edd59aecb

  • SHA1

    d0ea3d5f49ba6631a2eba4561030a8ff8859da18

  • SHA256

    ca4657dc6bccaa562f4209ccb37e5fddad1f2b60deef223031f752e4f486a106

  • SHA512

    8234ad6971a656f0ce2e92387a65eef2345bf281fd5f15532582928c42471826efdc04adf3b7e68a6e2f95666382b2e82de3fbae9b41d24fb83807e8accaa345

  • SSDEEP

    24576:JyfkQ016xeUl+BeoQWR1itBfJrqxUdAUdObjJfZmT8DOtMbe:8f1016Uc+4oQWqhrhdYjJxmT8J

Malware Config

Extracted

Family

redline

Botnet

kendo

C2

77.91.124.82:19071

Attributes
  • auth_value

    5a22a881561d49941415902859b51f14

Targets

    • Target

      ca4657dc6bccaa562f4209ccb37e5fddad1f2b60deef223031f752e4f486a106

    • Size

      929KB

    • MD5

      07a3992da323757a1f477b4edd59aecb

    • SHA1

      d0ea3d5f49ba6631a2eba4561030a8ff8859da18

    • SHA256

      ca4657dc6bccaa562f4209ccb37e5fddad1f2b60deef223031f752e4f486a106

    • SHA512

      8234ad6971a656f0ce2e92387a65eef2345bf281fd5f15532582928c42471826efdc04adf3b7e68a6e2f95666382b2e82de3fbae9b41d24fb83807e8accaa345

    • SSDEEP

      24576:JyfkQ016xeUl+BeoQWR1itBfJrqxUdAUdObjJfZmT8DOtMbe:8f1016Uc+4oQWqhrhdYjJxmT8J

    • Detect Mystic stealer payload

    • Mystic

      Mystic is an infostealer written in C++.

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks