Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
ef995e0b352b07375694fc7c7e4d51c622870af0371b0f53ad78e56e85dae5b5
-
Size
1.3MB
-
Sample
230301-fnqr3sef77
-
MD5
ad86a7cead4e451b4b39f872f7d6d1a6
-
SHA1
fea560c6c01692a1aae1f2aefd50f94b15c330bf
-
SHA256
ef995e0b352b07375694fc7c7e4d51c622870af0371b0f53ad78e56e85dae5b5
-
SHA512
db3f4b259d026863964e87391af2ac153f0e69f8995b9f61117c7aa331584ef7184a3dacfc4929da3c78dfd1da866bf501cbd8c69d62638a023d6aee30aba03a
-
SSDEEP
24576:bydwV5FKwqin75FPIzaOVmaHDLZ3VV4FFOp6EMP0EVNedN9+P3WPUe2sz10:Odw7FKbinIvEaHDvVAFDEMP0EVNE9MH0
Static task
static1
Malware Config
Extracted
redline
rumfa
193.233.20.24:4123
-
auth_value
749d02a6b4ef1fa2ad908e44ec2296dc
Extracted
amadey
3.67
193.233.20.14/BR54nmB3/index.php
Extracted
redline
forma
193.233.20.24:4123
-
auth_value
50b8e065d7cb1e9e30786f7a370368f9
Targets
-
-
Target
ef995e0b352b07375694fc7c7e4d51c622870af0371b0f53ad78e56e85dae5b5
-
Size
1.3MB
-
MD5
ad86a7cead4e451b4b39f872f7d6d1a6
-
SHA1
fea560c6c01692a1aae1f2aefd50f94b15c330bf
-
SHA256
ef995e0b352b07375694fc7c7e4d51c622870af0371b0f53ad78e56e85dae5b5
-
SHA512
db3f4b259d026863964e87391af2ac153f0e69f8995b9f61117c7aa331584ef7184a3dacfc4929da3c78dfd1da866bf501cbd8c69d62638a023d6aee30aba03a
-
SSDEEP
24576:bydwV5FKwqin75FPIzaOVmaHDLZ3VV4FFOp6EMP0EVNedN9+P3WPUe2sz10:Odw7FKbinIvEaHDvVAFDEMP0EVNE9MH0
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-