Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
9b1260f1ead313813e010d9cd7495bcb.bin
-
Size
899KB
-
Sample
230217-bs2ypacf5x
-
MD5
7250a257e132614a298f8e5b352abce4
-
SHA1
fe1f56bd02b8747d660670ccc9bb5d2fb25d1016
-
SHA256
ed6a272d610f01444c6fee50aa67ba21406b37dc35a7f2a05ffa05d13dbcf101
-
SHA512
6d9989e008c027a844934545fd466f070532628471fa1423ee962404a4f57db401bbfff2f9f5e4cf6e1e80b98273594a5d7df420f60c1af0f32188d230040601
-
SSDEEP
24576:ahtdJYvEqSS/RKXIrBwZjwKHaEtU0clQNysUMFWr9vahLowOQCdOn:ahtIs4UoUjwKHa2UfQkstMr9vuBSu
Static task
static1
Behavioral task
behavioral1
Sample
96e6e9f35a738b985bd710cff9f20219ba1d831c11deef8664899a14e67ad0a1.exe
Resource
win7-20221111-en
Malware Config
Extracted
redline
dubka
193.233.20.13:4136
-
auth_value
e5a9421183a033f283b2f23139b471f0
Extracted
redline
ruma
193.233.20.13:4136
-
auth_value
647d00dfaba082a4a30f383bca5d1a2a
Extracted
amadey
3.66
193.233.20.2/Bn89hku/index.php
Extracted
redline
cr10
176.113.115.17:4132
-
auth_value
0a52a09c70a98bb6612362e5eb8b1d02
Targets
-
-
Target
96e6e9f35a738b985bd710cff9f20219ba1d831c11deef8664899a14e67ad0a1.exe
-
Size
949KB
-
MD5
9b1260f1ead313813e010d9cd7495bcb
-
SHA1
98c47f13ac00819608546ddfc02017e7eb027536
-
SHA256
96e6e9f35a738b985bd710cff9f20219ba1d831c11deef8664899a14e67ad0a1
-
SHA512
d6a1957aa4c5eb1e8f0d6f6d53e05f2600d1a841294cf2b211928e665ed0dfe291ce2faac28cfb2482b2117539f264e123e281cc01d0df0cf597abfbc1d55627
-
SSDEEP
24576:FyVZaHHWdGUMol7j+CJvcGVrrXq2zvs4lLnLr7:gzQHbUVf+Qvxr62LD7Lr
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext
-