Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
38397d720f9326ebbcabaafec9a4bcb2b4ffc570f0b13c1286d012d782d8ee21
-
Size
125KB
-
Sample
220907-tgmczahgdk
-
MD5
1848fdc87bdca739ad8afd23f24c9722
-
SHA1
b1d0b0fde7ea1dd7a5c802fc08f03f56e898063d
-
SHA256
38397d720f9326ebbcabaafec9a4bcb2b4ffc570f0b13c1286d012d782d8ee21
-
SHA512
de0755785a33fbb1287749defaa6ecf4ffea7d17e11585a2b54e46347fefb2923520fe31ea7e35e1b8f125e2e3e33c356d7c0b1ac22f0a2c222f4bf49af3e6e9
-
SSDEEP
3072:teDUKLopZwbh7nTmHFQBFjXoPkbBNfp7o1/FwiibX9p:tUMm7n5LXeTibtp
Static task
static1
Behavioral task
behavioral1
Sample
38397d720f9326ebbcabaafec9a4bcb2b4ffc570f0b13c1286d012d782d8ee21.exe
Resource
win10-20220812-en
Malware Config
Extracted
redline
1337
78.153.144.6:2510
-
auth_value
b0447922bcbc2eda83260a9e7a638f45
Extracted
redline
nam5
103.89.90.61:34589
-
auth_value
f23be8e9063fe5d0c6fc3ee8e7d565bd
Targets
-
-
Target
38397d720f9326ebbcabaafec9a4bcb2b4ffc570f0b13c1286d012d782d8ee21
-
Size
125KB
-
MD5
1848fdc87bdca739ad8afd23f24c9722
-
SHA1
b1d0b0fde7ea1dd7a5c802fc08f03f56e898063d
-
SHA256
38397d720f9326ebbcabaafec9a4bcb2b4ffc570f0b13c1286d012d782d8ee21
-
SHA512
de0755785a33fbb1287749defaa6ecf4ffea7d17e11585a2b54e46347fefb2923520fe31ea7e35e1b8f125e2e3e33c356d7c0b1ac22f0a2c222f4bf49af3e6e9
-
SSDEEP
3072:teDUKLopZwbh7nTmHFQBFjXoPkbBNfp7o1/FwiibX9p:tUMm7n5LXeTibtp
-
Detects Smokeloader packer
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Suspicious use of SetThreadContext
-