Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    204a9aa1ea906ad7f1ee0703c9421811

  • Size

    267KB

  • Sample

    231230-3nbdqagea6

  • MD5

    204a9aa1ea906ad7f1ee0703c9421811

  • SHA1

    c822af84366d31e2010b0d64b5bad76874e46003

  • SHA256

    6a3c19972b3985addcf133112afd22c0d07f402e7dba75a184042a080c84496c

  • SHA512

    c14ce31963317d075c106cc4eb8da257e24cfc33d0890ce6a52e1783082851292655948d5264931309edac6c67978c3009bf2daee6f10348c06a40383fb95119

  • SSDEEP

    6144:mdvXs3oUzpjHt5WEHSCh9wBYEAN+sSZ5yLwuwyBp:UvWn1PWSjwBRXjyBp

Malware Config

Extracted

Family

redline

Botnet

AGRE

C2

141.95.24.235:33134

Targets

    • Target

      204a9aa1ea906ad7f1ee0703c9421811

    • Size

      267KB

    • MD5

      204a9aa1ea906ad7f1ee0703c9421811

    • SHA1

      c822af84366d31e2010b0d64b5bad76874e46003

    • SHA256

      6a3c19972b3985addcf133112afd22c0d07f402e7dba75a184042a080c84496c

    • SHA512

      c14ce31963317d075c106cc4eb8da257e24cfc33d0890ce6a52e1783082851292655948d5264931309edac6c67978c3009bf2daee6f10348c06a40383fb95119

    • SSDEEP

      6144:mdvXs3oUzpjHt5WEHSCh9wBYEAN+sSZ5yLwuwyBp:UvWn1PWSjwBRXjyBp

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks