Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    7981bc15a329fe58ae76f26d03fbcab5d7c32658f29a1529d4d83b9e377a81a4.exe

  • Size

    95KB

  • Sample

    240418-bw79wage61

  • MD5

    9001b4d829eac33f2b06ab34bbef7480

  • SHA1

    108914745f61a7502a382871345d4af604814823

  • SHA256

    7981bc15a329fe58ae76f26d03fbcab5d7c32658f29a1529d4d83b9e377a81a4

  • SHA512

    511cedc75dc75eef63953f7238d1d7f25b6ffc0e36f0f6e0589d58f642b4c87607a70414305905a7b57295ebe176bf51c1a84d0308f0f93287e52b3afd3b4cea

  • SSDEEP

    1536:WqsoPqsglbG6jejoigIn43Ywzi0Zb78ivombfexv0ujXyyed2jtQulgS6pE:E2fwYn+zi0ZbYe1g0ujyzdlE

Malware Config

Extracted

Family

redline

Botnet

--- https://t.me/BlToolsCloud ------ https://t.me/BlTools_Logs ---

C2

rights-mountains.gl.at.ply.gg:23403

Targets

    • Target

      7981bc15a329fe58ae76f26d03fbcab5d7c32658f29a1529d4d83b9e377a81a4.exe

    • Size

      95KB

    • MD5

      9001b4d829eac33f2b06ab34bbef7480

    • SHA1

      108914745f61a7502a382871345d4af604814823

    • SHA256

      7981bc15a329fe58ae76f26d03fbcab5d7c32658f29a1529d4d83b9e377a81a4

    • SHA512

      511cedc75dc75eef63953f7238d1d7f25b6ffc0e36f0f6e0589d58f642b4c87607a70414305905a7b57295ebe176bf51c1a84d0308f0f93287e52b3afd3b4cea

    • SSDEEP

      1536:WqsoPqsglbG6jejoigIn43Ywzi0Zb78ivombfexv0ujXyyed2jtQulgS6pE:E2fwYn+zi0ZbYe1g0ujyzdlE

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v15

Tasks