Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
1292caa7f905553fbae68ab8c4b16c52d8addfc26be2354dfa829a1d8bb36f87
-
Size
769KB
-
Sample
230213-g7thrabd48
-
MD5
86bbf5998fb17be867ae280cc16cfe14
-
SHA1
e1ad942495dc45c55997fc022b5bf840e55f51fc
-
SHA256
1292caa7f905553fbae68ab8c4b16c52d8addfc26be2354dfa829a1d8bb36f87
-
SHA512
a2eea111d088782d5109ced41972e8172a457d3d246cbc75a8b0dcfea9b8809e5c245eeacb0a5bf30fb80eba994b9cf7913c4d408e4d0f4db704c18d969112f2
-
SSDEEP
12288:wMrGy90uKQvGEp6jamOtn+YUxdZ6wJ0fjTn5qbyn1Pdxb5seWL8kz+FZu:my7zvGEpt1tKqHnYunzwe8QHu
Static task
static1
Malware Config
Extracted
redline
romik
193.233.20.12:4132
-
auth_value
8fb78d2889ba0ca42678b59b884e88ff
Extracted
redline
dunm
193.233.20.12:4132
-
auth_value
352959e3707029296ec94306d74e2334
Extracted
redline
cr2
176.113.115.17:4132
-
auth_value
4bf573d6f5ab16f3b5e36da6855dc128
Targets
-
-
Target
1292caa7f905553fbae68ab8c4b16c52d8addfc26be2354dfa829a1d8bb36f87
-
Size
769KB
-
MD5
86bbf5998fb17be867ae280cc16cfe14
-
SHA1
e1ad942495dc45c55997fc022b5bf840e55f51fc
-
SHA256
1292caa7f905553fbae68ab8c4b16c52d8addfc26be2354dfa829a1d8bb36f87
-
SHA512
a2eea111d088782d5109ced41972e8172a457d3d246cbc75a8b0dcfea9b8809e5c245eeacb0a5bf30fb80eba994b9cf7913c4d408e4d0f4db704c18d969112f2
-
SSDEEP
12288:wMrGy90uKQvGEp6jamOtn+YUxdZ6wJ0fjTn5qbyn1Pdxb5seWL8kz+FZu:my7zvGEpt1tKqHnYunzwe8QHu
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Executes dropped EXE
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext
-