Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
7fbd16011102b6607800265befac4a41548b30b43ff20308868f6c07b660a56b
-
Size
690KB
-
Sample
230306-smn83sda35
-
MD5
73853428e1e1b7f7a236a135c64fa77c
-
SHA1
e367b3d294fe8c625afa54ff399592eafaaff3a8
-
SHA256
7fbd16011102b6607800265befac4a41548b30b43ff20308868f6c07b660a56b
-
SHA512
c0b3caff28e2b82b1b1269ad5f69bdfe44da415b983ee0d49afe0786bfe7b5721915e5f564e7d649e99bec6ea89ce75750db5f594951d30870010f3fe983a99d
-
SSDEEP
12288:ZMray90rlY8IqTQW/L5TznidjAxTkdPSVIGh6k0XYZ0jy7zze+:ny0IqTQW/LVOKTk096k6Ymjy7zX
Static task
static1
Behavioral task
behavioral1
Sample
7fbd16011102b6607800265befac4a41548b30b43ff20308868f6c07b660a56b.exe
Resource
win10v2004-20230220-en
Malware Config
Extracted
amadey
3.68
193.233.20.26/Do3m4Gor/index.php
Extracted
redline
fabio
193.233.20.27:4123
-
auth_value
56b82736c3f56b13be8e64c87d2cf9e5
Targets
-
-
Target
7fbd16011102b6607800265befac4a41548b30b43ff20308868f6c07b660a56b
-
Size
690KB
-
MD5
73853428e1e1b7f7a236a135c64fa77c
-
SHA1
e367b3d294fe8c625afa54ff399592eafaaff3a8
-
SHA256
7fbd16011102b6607800265befac4a41548b30b43ff20308868f6c07b660a56b
-
SHA512
c0b3caff28e2b82b1b1269ad5f69bdfe44da415b983ee0d49afe0786bfe7b5721915e5f564e7d649e99bec6ea89ce75750db5f594951d30870010f3fe983a99d
-
SSDEEP
12288:ZMray90rlY8IqTQW/L5TznidjAxTkdPSVIGh6k0XYZ0jy7zze+:ny0IqTQW/LVOKTk096k6Ymjy7zX
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-