Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    ee88a284fb166e55f13a75ea3096d22c

  • Size

    1.3MB

  • Sample

    231012-szdm4sba85

  • MD5

    ee88a284fb166e55f13a75ea3096d22c

  • SHA1

    8d1ca81068a1286f89ce4bc23a4ce3d3e5bf64e4

  • SHA256

    0fc6f52cae946a367dca16728eab871b1610fc044c2bc3d5ab640a71e49e50a1

  • SHA512

    aadde4249c9ee5db44abc503dcc58e06ab305951b2ee37c432f1013cfed67e8734eb7dc833cf920784f79a7e599125ee8a10ba95cbe769779bea562799080dc7

  • SSDEEP

    24576:qg9yLp0HmYObBpsiWo/8M8zmssIpcbiLq96:FJHmYOb0gPWg

Malware Config

Extracted

Family

redline

Botnet

LegendaryInstalls_20230918

C2

62.72.23.19:80

Attributes
  • auth_value

    7e2e28855818d91285389c56372566f4

Targets

    • Target

      ee88a284fb166e55f13a75ea3096d22c

    • Size

      1.3MB

    • MD5

      ee88a284fb166e55f13a75ea3096d22c

    • SHA1

      8d1ca81068a1286f89ce4bc23a4ce3d3e5bf64e4

    • SHA256

      0fc6f52cae946a367dca16728eab871b1610fc044c2bc3d5ab640a71e49e50a1

    • SHA512

      aadde4249c9ee5db44abc503dcc58e06ab305951b2ee37c432f1013cfed67e8734eb7dc833cf920784f79a7e599125ee8a10ba95cbe769779bea562799080dc7

    • SSDEEP

      24576:qg9yLp0HmYObBpsiWo/8M8zmssIpcbiLq96:FJHmYOb0gPWg

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • Uses the VBS compiler for execution

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks