Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

1

URLScan

urlscan

1

http://p1t.fun/?l=10...

windows10-1703-x64

10

Resubmissions

15/06/2024, 11:23

240615-nhcx2aydmb 1

15/06/2024, 11:22

240615-ng1byaydke 1

15/06/2024, 11:16

240615-ndewtsscnq 10

14/06/2024, 17:58

240614-wkcn2svbrk 10

14/06/2024, 17:57

240614-wjtaeavbpj 1

14/06/2024, 17:56

240614-wh8npsvbnj 1

14/06/2024, 17:55

240614-whjdtavblj 1

14/06/2024, 16:38

240614-t5wxbaycqb 10

14/06/2024, 16:38

240614-t5hppaycpe 1

14/06/2024, 16:37

240614-t42feaycne 1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    http://p1t.fun/?l=1031

  • Sample

    240614-t5wxbaycqb

Score
10/10
redline1467997772discoveryinfostealerpersistencespyware

Malware Config

Extracted

Family

redline

Botnet

1467997772

C2

https://t.me/+7Lir0e4Gw381MDhi*https://steamcommunity.com/id/993846634744/

Targets

    • Target

      http://p1t.fun/?l=1031

    Score
    10/10
    redline1467997772discoveryinfostealerpersistencespyware

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Registers COM server for autorun

      persistence

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Suspicious use of SetThreadContext

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks