Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

6ef663c3a5...2f.exe

windows7-x64

10

6ef663c3a5...2f.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    6ef663c3a59714417118388d0be7ff6d6dd6bfe65cd49240158972e9ea14d02f

  • Size

    123KB

  • Sample

    230103-b3ewxace8z

  • MD5

    2ca4c3f2c54cc9919b9141f6cc7574b3

  • SHA1

    351e3c423da5d942e8bc0a804a16525ba5f25915

  • SHA256

    77aa700dd73da2abbd167c4e339f9f262dd34c31092d5bac14edd267eeb0c1bf

  • SHA512

    f56ae89ae031d1dc7a29f1ccbf0271db594b6dad5460db36080719af4c8efb769b03568516c6353724804a17a1cbcbebf6d99463cf606b1a65ff3811fc90097c

  • SSDEEP

    3072:v/kQb3eTdnyr9TGChke+wNeXqK8QkszQ2bsERvN:pLeTxyJLhkwN4qKlksMyl

Score
10/10
redlinepub1infostealerspyware

Malware Config

Extracted

Family

redline

Botnet

pub1

C2

89.22.231.25:45245

Attributes
  • auth_value

    9c5c8480222ae57e3bcdac11c63a526d

Targets

    • Target

      6ef663c3a59714417118388d0be7ff6d6dd6bfe65cd49240158972e9ea14d02f

    • Size

      285KB

    • MD5

      3c964d4dbac1fe7d1d1f22c3c4117a7f

    • SHA1

      8e183d913cdb52525b031f09582b2051a158778d

    • SHA256

      6ef663c3a59714417118388d0be7ff6d6dd6bfe65cd49240158972e9ea14d02f

    • SHA512

      278f2f5c3c1f0b4a6af8dbe0f5b1d07dfe9e081a8cce14cdb4c6991b16cd44ce5aa068d2e1ed363ff012190e215c07c699f757e8a77fddd11e861f0ce792938c

    • SSDEEP

      6144:wWd9WTYysJfeB7o+rH2jctiP2Aj2LaV+z6jZEl:wWd9WTYtmHII4xj2La9I

    Score
    10/10
    redlinepub1infostealerspyware

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • Uses the VBS compiler for execution

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks