Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    cf3b53988f8ac41ceb4e2941d1ae3f36dcd34766f527e1c51f7513869d8b4a15

  • Size

    314KB

  • Sample

    240508-aysfrsbh63

  • MD5

    d17e839ac938c0fe1b5ae61e458e2879

  • SHA1

    5f5d2368b3c5d91560af9ba4a3dc6a8907c4d81d

  • SHA256

    cf3b53988f8ac41ceb4e2941d1ae3f36dcd34766f527e1c51f7513869d8b4a15

  • SHA512

    0a3b91c8fbb04aa49716a3fef14e6828376c5004607138b74bc3c422e1dc5e70d7c0d9b4ad56b0d94d3e1d15082ad577922d3d9878741efd01a88d2fc765b261

  • SSDEEP

    6144:l5npI60nbM8uPZy3+8KID1BurfcqslPdDMQ44I1XrZXHS:7n+60nbnuuBcvQp54vNHS

Malware Config

Extracted

Family

redline

Botnet

5637482599

C2

https://pastebin.com/raw/NgsUAPya

Targets

    • Target

      cf3b53988f8ac41ceb4e2941d1ae3f36dcd34766f527e1c51f7513869d8b4a15

    • Size

      314KB

    • MD5

      d17e839ac938c0fe1b5ae61e458e2879

    • SHA1

      5f5d2368b3c5d91560af9ba4a3dc6a8907c4d81d

    • SHA256

      cf3b53988f8ac41ceb4e2941d1ae3f36dcd34766f527e1c51f7513869d8b4a15

    • SHA512

      0a3b91c8fbb04aa49716a3fef14e6828376c5004607138b74bc3c422e1dc5e70d7c0d9b4ad56b0d94d3e1d15082ad577922d3d9878741efd01a88d2fc765b261

    • SSDEEP

      6144:l5npI60nbM8uPZy3+8KID1BurfcqslPdDMQ44I1XrZXHS:7n+60nbnuuBcvQp54vNHS

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Legitimate hosting services abused for malware hosting/C2

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks