Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
266b8b19e3e00ebc41e21390e4c1e6bf2cd48439ba3d0c3318f9ca689447f60d
-
Size
759KB
-
Sample
230212-2h3qcagd5y
-
MD5
f00e0445cd7330be8fc6f891e279e643
-
SHA1
2bd60ec9ff457cef342733ed50b05711e965d46f
-
SHA256
266b8b19e3e00ebc41e21390e4c1e6bf2cd48439ba3d0c3318f9ca689447f60d
-
SHA512
b332987086514950d2ffad92ce904d676e454243057376c2de8683ff91f4424c0706533e4a5fa5a8ed64d65e1198286ee5cca059ee3eb76edb05f117161ccf19
-
SSDEEP
12288:NMrvy90J17+ZxPCwTwWRRPextYb2llaxaRFr9khCYKsjXvt6wSKmFelY:Cyg+ZxPmWXs2ervRFYjft6wSlFe6
Static task
static1
Malware Config
Extracted
redline
romik
193.233.20.12:4132
-
auth_value
8fb78d2889ba0ca42678b59b884e88ff
Extracted
redline
dunm
193.233.20.12:4132
-
auth_value
352959e3707029296ec94306d74e2334
Extracted
redline
cr2
176.113.115.17:4132
-
auth_value
4bf573d6f5ab16f3b5e36da6855dc128
Targets
-
-
Target
266b8b19e3e00ebc41e21390e4c1e6bf2cd48439ba3d0c3318f9ca689447f60d
-
Size
759KB
-
MD5
f00e0445cd7330be8fc6f891e279e643
-
SHA1
2bd60ec9ff457cef342733ed50b05711e965d46f
-
SHA256
266b8b19e3e00ebc41e21390e4c1e6bf2cd48439ba3d0c3318f9ca689447f60d
-
SHA512
b332987086514950d2ffad92ce904d676e454243057376c2de8683ff91f4424c0706533e4a5fa5a8ed64d65e1198286ee5cca059ee3eb76edb05f117161ccf19
-
SSDEEP
12288:NMrvy90J17+ZxPCwTwWRRPextYb2llaxaRFr9khCYKsjXvt6wSKmFelY:Cyg+ZxPmWXs2ervRFYjft6wSlFe6
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Executes dropped EXE
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext
-