Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
f13b278976ed4a4a2cd0c782bc76a2597d358a79c6e7f998b7c95ee21bb206ae
-
Size
138KB
-
Sample
221203-zzb8lsef55
-
MD5
3a65d5ee4d0c15d3f7902ca3e2c3a447
-
SHA1
7c4fd72a146b5c13f12d69f30a552f3c9e7ed7e7
-
SHA256
edad9ea1c7527d8375a81b5a63f2defeb42633771a2244b7f042881ed295cb06
-
SHA512
92e820090fc4203d49447c1b069a33ea1832a191e968805b7e9b2ffd2f530609a797317c0f10b237d41c5b600967a3229bff8f9217417a2f7ce49f15e9a50814
-
SSDEEP
3072:Y7bXhBYcK+ZEpeaOBQ1F94wujHvDD3ofCQYHxJxP3IAV6Lx/gH0zj9T37:Y/HYcdZnaVD94rjHLUfCQgmA41rzj9Tr
Static task
static1
Behavioral task
behavioral1
Sample
f13b278976ed4a4a2cd0c782bc76a2597d358a79c6e7f998b7c95ee21bb206ae.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
f13b278976ed4a4a2cd0c782bc76a2597d358a79c6e7f998b7c95ee21bb206ae.exe
Resource
win10v2004-20221111-en
Malware Config
Extracted
redline
@P1
193.106.191.138:32796
-
auth_value
54c79ce081122137049ee07c0a2f38ab
Targets
-
-
Target
f13b278976ed4a4a2cd0c782bc76a2597d358a79c6e7f998b7c95ee21bb206ae
-
Size
217KB
-
MD5
883749fce20bc27382131894e7f9451d
-
SHA1
61015691b274bf7f9cc2592d372c11d38219c325
-
SHA256
f13b278976ed4a4a2cd0c782bc76a2597d358a79c6e7f998b7c95ee21bb206ae
-
SHA512
d8a3bbdfdb5adf2c67bb1b38d2d05a86ee2aa3caee60fc4af5c256afd11ce8609556e3d7ce50593d933a7d9f3b0aabdfb90a6e3fdcbb101a538404e57dc00230
-
SSDEEP
3072:cliRSiFzW0qu7b4ee8fwmGzPMWxS+bsqLCX3knb95IcWdXCY9bTAIrFldI0cBxO:cliRSwNveMwTDM4RVCkbSCY9fSC
Score10/10-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Uses the VBS compiler for execution
-
Suspicious use of SetThreadContext
-