Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
392de779e8aad944610da38650d4a70cea90b552639b66abd87d64a70df739fc
-
Size
288KB
-
Sample
221230-zftcsage69
-
MD5
446bcd383aac5220a6f5d1ad3deaad30
-
SHA1
44c10410644922fdae49cf536ec4187081c05f82
-
SHA256
392de779e8aad944610da38650d4a70cea90b552639b66abd87d64a70df739fc
-
SHA512
f2ada3aa4bb6a0bc89e7393debad3701345c72f811279af52f256eee2164b47bbaf3641edc454312a39f52786e3ed87e5be4bb4b6194a810bd1e66ef10e9bc1b
-
SSDEEP
3072:LtoKf7G89LgSLV44RBWImOmquhSjKLhwz3PVfyLGsoEiL+8U9SkEqwi:fC2L3V4MWgrOhQ9fof8UIkEq
Static task
static1
Behavioral task
behavioral1
Sample
392de779e8aad944610da38650d4a70cea90b552639b66abd87d64a70df739fc.exe
Resource
win10v2004-20220812-en
Malware Config
Extracted
redline
Redline Bot
193.42.244.249:5514
-
auth_value
dba2cba3a65b70477f54eb1d91e5f886
Extracted
redline
pub2
89.22.231.25:45245
-
auth_value
ea9464d486a641bb513057e5f63399e1
Targets
-
-
Target
392de779e8aad944610da38650d4a70cea90b552639b66abd87d64a70df739fc
-
Size
288KB
-
MD5
446bcd383aac5220a6f5d1ad3deaad30
-
SHA1
44c10410644922fdae49cf536ec4187081c05f82
-
SHA256
392de779e8aad944610da38650d4a70cea90b552639b66abd87d64a70df739fc
-
SHA512
f2ada3aa4bb6a0bc89e7393debad3701345c72f811279af52f256eee2164b47bbaf3641edc454312a39f52786e3ed87e5be4bb4b6194a810bd1e66ef10e9bc1b
-
SSDEEP
3072:LtoKf7G89LgSLV44RBWImOmquhSjKLhwz3PVfyLGsoEiL+8U9SkEqwi:fC2L3V4MWgrOhQ9fof8UIkEq
-
Detects Smokeloader packer
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Uses the VBS compiler for execution
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Suspicious use of SetThreadContext
-