Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
6c12e93fc043fc7c6abc1f1ccb95715b7b9f9710450559c4340bf7a4c94d689c
-
Size
478KB
-
Sample
230211-2gfjescg67
-
MD5
7e278af5d1e46277e4dcc002de5bbe8e
-
SHA1
d7d70f8baf60dfb08fff95dedb3e9312b98ae1d5
-
SHA256
6c12e93fc043fc7c6abc1f1ccb95715b7b9f9710450559c4340bf7a4c94d689c
-
SHA512
792223c63794d14f2f6c715dc6fe0251b7a8538b1449f222d3a02dce0a13202a7dace14cea3af0a5a61115e571f71086414adeec0c6ad15a1391b4cc5ddfd110
-
SSDEEP
12288:gMrzy90Brj8q+VeYJs42ExkDWyKmxexDirMhzT5nhsHP:DyWrIRVm3fKkeOMzhsv
Static task
static1
Behavioral task
behavioral1
Sample
6c12e93fc043fc7c6abc1f1ccb95715b7b9f9710450559c4340bf7a4c94d689c.exe
Resource
win10v2004-20221111-en
Malware Config
Extracted
redline
fusa
193.233.20.12:4132
-
auth_value
a08b2f01bd2af756e38c5dd60e87e697
Extracted
redline
nocrypt
176.113.115.17:4132
-
auth_value
4fc7cda1ab5883a6197f20f517ce2a8c
Targets
-
-
Target
6c12e93fc043fc7c6abc1f1ccb95715b7b9f9710450559c4340bf7a4c94d689c
-
Size
478KB
-
MD5
7e278af5d1e46277e4dcc002de5bbe8e
-
SHA1
d7d70f8baf60dfb08fff95dedb3e9312b98ae1d5
-
SHA256
6c12e93fc043fc7c6abc1f1ccb95715b7b9f9710450559c4340bf7a4c94d689c
-
SHA512
792223c63794d14f2f6c715dc6fe0251b7a8538b1449f222d3a02dce0a13202a7dace14cea3af0a5a61115e571f71086414adeec0c6ad15a1391b4cc5ddfd110
-
SSDEEP
12288:gMrzy90Brj8q+VeYJs42ExkDWyKmxexDirMhzT5nhsHP:DyWrIRVm3fKkeOMzhsv
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Executes dropped EXE
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-