Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
a021adfbf060749ef48664aa221466b0e8aeaf2d75e58b742f5a50f3387a9f86
-
Size
948KB
-
Sample
230217-hld2lseb78
-
MD5
f3f9a819d74d7b3bb7578979d0b0e1c6
-
SHA1
4491c7a35326a852fe62cd1b270ce1673bd02a81
-
SHA256
a021adfbf060749ef48664aa221466b0e8aeaf2d75e58b742f5a50f3387a9f86
-
SHA512
f47fd9dec448e4989d42d0b32d1e4c58a77f85e30363e1867042dc0fad6cc857ca196c1951ece65929ad1c334de755214d4f58a62c78409a901a83745c148049
-
SSDEEP
24576:jyPrctZMPlhrXawM8UomAdd21i30sIQGBnNOsuBSEqmfBtW:2Prcylh7awTUu21iE7NO/SE
Static task
static1
Malware Config
Extracted
redline
dubka
193.233.20.13:4136
-
auth_value
e5a9421183a033f283b2f23139b471f0
Extracted
amadey
3.66
193.233.20.2/Bn89hku/index.php
Extracted
redline
kk1
176.113.115.17:4132
-
auth_value
df169d3f7f631272f7c6bd9a1bb603c3
Targets
-
-
Target
a021adfbf060749ef48664aa221466b0e8aeaf2d75e58b742f5a50f3387a9f86
-
Size
948KB
-
MD5
f3f9a819d74d7b3bb7578979d0b0e1c6
-
SHA1
4491c7a35326a852fe62cd1b270ce1673bd02a81
-
SHA256
a021adfbf060749ef48664aa221466b0e8aeaf2d75e58b742f5a50f3387a9f86
-
SHA512
f47fd9dec448e4989d42d0b32d1e4c58a77f85e30363e1867042dc0fad6cc857ca196c1951ece65929ad1c334de755214d4f58a62c78409a901a83745c148049
-
SSDEEP
24576:jyPrctZMPlhrXawM8UomAdd21i30sIQGBnNOsuBSEqmfBtW:2Prcylh7awTUu21iE7NO/SE
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext
-