Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    5240773ffa3a72a2d31a6a4aced652979b2662efaab2c7bcc28a1a67bd5b7696.exe

  • Size

    464KB

  • Sample

    240218-gfxq4afa29

  • MD5

    344ab5f6badfc8e09e9b8384f5cb3e60

  • SHA1

    1213df1776390d5a9acd3395f0b806bbae13127f

  • SHA256

    5240773ffa3a72a2d31a6a4aced652979b2662efaab2c7bcc28a1a67bd5b7696

  • SHA512

    523ac88b7a2eaefb30afb73e68d2ce1dc58d439d013dffa5db29031add6fc6d40727a42d9a0d2b11076dcc395604caf3ceb4017dc334345b4fccb2c6db4e0e43

  • SSDEEP

    12288:fdhvZeiD9j3AaVZ3r1l5D/Ei1t1egcCpRScNsuCWJuffs:fdhBD9jjZ3rJLX0gcm9GuCWoff

Malware Config

Targets

    • Target

      5240773ffa3a72a2d31a6a4aced652979b2662efaab2c7bcc28a1a67bd5b7696.exe

    • Size

      464KB

    • MD5

      344ab5f6badfc8e09e9b8384f5cb3e60

    • SHA1

      1213df1776390d5a9acd3395f0b806bbae13127f

    • SHA256

      5240773ffa3a72a2d31a6a4aced652979b2662efaab2c7bcc28a1a67bd5b7696

    • SHA512

      523ac88b7a2eaefb30afb73e68d2ce1dc58d439d013dffa5db29031add6fc6d40727a42d9a0d2b11076dcc395604caf3ceb4017dc334345b4fccb2c6db4e0e43

    • SSDEEP

      12288:fdhvZeiD9j3AaVZ3r1l5D/Ei1t1egcCpRScNsuCWJuffs:fdhBD9jjZ3rJLX0gcm9GuCWoff

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v15

Tasks