Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
5182f47a62c2d19e7ec69af9c805ecf714ea07453d7b14a6d7341c6d15a58e57
-
Size
1000KB
-
Sample
230216-qsk3hahf98
-
MD5
aa3b7d5d30e9d83ff9805720c85477a8
-
SHA1
b4801ae2959676c8d1be2241add63bf430774dde
-
SHA256
5182f47a62c2d19e7ec69af9c805ecf714ea07453d7b14a6d7341c6d15a58e57
-
SHA512
1914ca05877158fe6c241a45065ecd1425e8f1c16396d764726f72a7d2606178e0d15e4e99df9d6ea975ea54573c0651f7c26d5248b4ab88a4284f74586f0b37
-
SSDEEP
24576:tyDoV47qXQ660Nk13mhs4d6IshIL9QI8so97CTQ:IDpev60Nm2htduyxU
Static task
static1
Behavioral task
behavioral1
Sample
5182f47a62c2d19e7ec69af9c805ecf714ea07453d7b14a6d7341c6d15a58e57.exe
Resource
win10v2004-20220812-en
Malware Config
Extracted
redline
dubka
193.233.20.13:4136
-
auth_value
e5a9421183a033f283b2f23139b471f0
Extracted
redline
nock
176.113.115.17:4132
-
auth_value
f32d3c6ff0a9a7632c60a2b045a9cde6
Targets
-
-
Target
5182f47a62c2d19e7ec69af9c805ecf714ea07453d7b14a6d7341c6d15a58e57
-
Size
1000KB
-
MD5
aa3b7d5d30e9d83ff9805720c85477a8
-
SHA1
b4801ae2959676c8d1be2241add63bf430774dde
-
SHA256
5182f47a62c2d19e7ec69af9c805ecf714ea07453d7b14a6d7341c6d15a58e57
-
SHA512
1914ca05877158fe6c241a45065ecd1425e8f1c16396d764726f72a7d2606178e0d15e4e99df9d6ea975ea54573c0651f7c26d5248b4ab88a4284f74586f0b37
-
SSDEEP
24576:tyDoV47qXQ660Nk13mhs4d6IshIL9QI8so97CTQ:IDpev60Nm2htduyxU
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Executes dropped EXE
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-