Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
1daae8343986e67f99aff5df1a9a18286dcbb5a2ceffd7bd9e6885f642a33e73
-
Size
385KB
-
Sample
230308-11f4mahd49
-
MD5
cff3641306bfb479353d12010f4d9e7e
-
SHA1
be4fd279c3bf6f559b2ccb15d60d5949fbada1ad
-
SHA256
1daae8343986e67f99aff5df1a9a18286dcbb5a2ceffd7bd9e6885f642a33e73
-
SHA512
4035957699740023ed3c47e4ab13b326142aff767d770eac0281352dac62dafd7ed6c4ff4ffd52875e7930e6e0264714c6e08bb741afb2f0a6cfcdc10d7fd699
-
SSDEEP
6144:Koy+bnr+ap0yN90QEFnJV63upgdOUlnRXE06NgnUW/wAXCEreDJ5pK+nB35s6B:AMrGy90NCNd/nR00jnUewASx5pV5s6B
Static task
static1
Behavioral task
behavioral1
Sample
1daae8343986e67f99aff5df1a9a18286dcbb5a2ceffd7bd9e6885f642a33e73.exe
Resource
win10v2004-20230220-en
Malware Config
Extracted
redline
mango
193.233.20.28:4125
-
auth_value
ecf79d7f5227d998a3501c972d915d23
Targets
-
-
Target
1daae8343986e67f99aff5df1a9a18286dcbb5a2ceffd7bd9e6885f642a33e73
-
Size
385KB
-
MD5
cff3641306bfb479353d12010f4d9e7e
-
SHA1
be4fd279c3bf6f559b2ccb15d60d5949fbada1ad
-
SHA256
1daae8343986e67f99aff5df1a9a18286dcbb5a2ceffd7bd9e6885f642a33e73
-
SHA512
4035957699740023ed3c47e4ab13b326142aff767d770eac0281352dac62dafd7ed6c4ff4ffd52875e7930e6e0264714c6e08bb741afb2f0a6cfcdc10d7fd699
-
SSDEEP
6144:Koy+bnr+ap0yN90QEFnJV63upgdOUlnRXE06NgnUW/wAXCEreDJ5pK+nB35s6B:AMrGy90NCNd/nR00jnUewASx5pV5s6B
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Executes dropped EXE
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-