Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
file.exe
-
Size
2.6MB
-
Sample
221018-yqy6cadea9
-
MD5
2a70ae580def1610cd82e17af3a68732
-
SHA1
2b6371fe0a9748b6f12981a7d91f388b8f4708c6
-
SHA256
9d0d4efa6ce4cd3d21d8cdc6c8fd494bb6eebebdc2bde1afe22989f3b09544b0
-
SHA512
f8e0cd0c252df33068cc684a90f8eae1dcb054259f87d4080548c9ee677f50424db4c33ed11355aa2f6f2ff7301cf2b6bd6e3ce85107ff77e2f2464ab2334b30
-
SSDEEP
24576:01zCR848YIy3+RY+Y5Me/bfM+S0swdNAOmi/n2ECqoHY3zclKY72yELu4Dl3RuQO:01uRVky3tR2EeGCKY72yEBl3u
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20220812-en
Malware Config
Extracted
redline
new10181
denestyenol.xyz:81
exirdonanos.xyz:81
-
auth_value
9c9460be2b03696a2927339c6ea79201
Targets
-
-
Target
file.exe
-
Size
2.6MB
-
MD5
2a70ae580def1610cd82e17af3a68732
-
SHA1
2b6371fe0a9748b6f12981a7d91f388b8f4708c6
-
SHA256
9d0d4efa6ce4cd3d21d8cdc6c8fd494bb6eebebdc2bde1afe22989f3b09544b0
-
SHA512
f8e0cd0c252df33068cc684a90f8eae1dcb054259f87d4080548c9ee677f50424db4c33ed11355aa2f6f2ff7301cf2b6bd6e3ce85107ff77e2f2464ab2334b30
-
SSDEEP
24576:01zCR848YIy3+RY+Y5Me/bfM+S0swdNAOmi/n2ECqoHY3zclKY72yELu4Dl3RuQO:01uRVky3tR2EeGCKY72yEBl3u
Score10/10-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Uses the VBS compiler for execution
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Suspicious use of SetThreadContext
-