Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
11eea129a22df67775e7f40644807e1263717c016010d62f3d771e602c0daee2
-
Size
715KB
-
Sample
230214-gtr3rsbc59
-
MD5
63f2def49618354ddb422f5fd0d49d43
-
SHA1
8a351282dd836f98b97aa6f22708d82971a242f1
-
SHA256
11eea129a22df67775e7f40644807e1263717c016010d62f3d771e602c0daee2
-
SHA512
07387a1daf2ab041bc4229457ba47f26c15ed03af19e78512d2050b88c331527570695fee30560b986550902b079fc239c4393a627b5e9d28aebb90bfa0e8ffe
-
SSDEEP
12288:zMrky900aZdBPXvWKHFVi1hsWjMvDXSJI4Cpbf88WfQdehXwb9Wo3+Oe:jy7S3xH/6suMvDXW+po8WLXwbIo33e
Static task
static1
Behavioral task
behavioral1
Sample
11eea129a22df67775e7f40644807e1263717c016010d62f3d771e602c0daee2.exe
Resource
win10v2004-20221111-en
Malware Config
Extracted
redline
fukia
193.233.20.13:4136
-
auth_value
e5783636fbd9e4f0cf9a017bce02e67e
Extracted
amadey
3.66
62.204.41.5/Bu58Ngs/index.php
Targets
-
-
Target
11eea129a22df67775e7f40644807e1263717c016010d62f3d771e602c0daee2
-
Size
715KB
-
MD5
63f2def49618354ddb422f5fd0d49d43
-
SHA1
8a351282dd836f98b97aa6f22708d82971a242f1
-
SHA256
11eea129a22df67775e7f40644807e1263717c016010d62f3d771e602c0daee2
-
SHA512
07387a1daf2ab041bc4229457ba47f26c15ed03af19e78512d2050b88c331527570695fee30560b986550902b079fc239c4393a627b5e9d28aebb90bfa0e8ffe
-
SSDEEP
12288:zMrky900aZdBPXvWKHFVi1hsWjMvDXSJI4Cpbf88WfQdehXwb9Wo3+Oe:jy7S3xH/6suMvDXW+po8WLXwbIo33e
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-