Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
fb355965642d20a78b7a471b60f0d6e2ec1f6ed6ec3560665244c57a506cd38d.zip
-
Size
586KB
-
Sample
230308-nddnrsfc5z
-
MD5
eccbaabe50fcdcb9e9dc8959785a073d
-
SHA1
b43844347fedf1a5de1193b8f070e10d294604c8
-
SHA256
9119cdd294b86695d3f246e74c198fab6cf89982928e50f92f414594b0a0a05c
-
SHA512
67a4d53d47b39357d7dbf5ea532845b93f9415fffb6f0dbf1a06341f0c2e0dcb7c5487b4aaa2150f5776b2a4a977af20733ed9a6633a66770a32f1c85ef40e09
-
SSDEEP
12288:7Wv+kRi8FIattem0BX/X0JKPDGxjCGj66ugKIRz8u37mptPIco:6RQ8WFBBvEEPDGxucnugPRz8a7mpZVo
Static task
static1
Behavioral task
behavioral1
Sample
fb355965642d20a78b7a471b60f0d6e2ec1f6ed6ec3560665244c57a506cd38d.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
fb355965642d20a78b7a471b60f0d6e2ec1f6ed6ec3560665244c57a506cd38d.exe
Resource
win10v2004-20230220-en
Malware Config
Extracted
redline
garry
193.56.146.11:4173
-
auth_value
210ba56bf751fefe327f26e00f0be5a9
Extracted
amadey
3.68
193.56.146.218/images/IMG_489440/index.php
Targets
-
-
Target
fb355965642d20a78b7a471b60f0d6e2ec1f6ed6ec3560665244c57a506cd38d.exe
-
Size
653KB
-
MD5
2b809d73b0b5062037119fd327fd5ab6
-
SHA1
bfbd54086f2099beeadb22834f9d2cfa3505e2c4
-
SHA256
fb355965642d20a78b7a471b60f0d6e2ec1f6ed6ec3560665244c57a506cd38d
-
SHA512
d8b9b90abd2ca40536a9cfdd7c270819416c45c6894f29715914a85e5e9db935919e5c100e46e669a628e4d9f15d0066284fd92a858e32d762f015863a8766bc
-
SSDEEP
12288:pJI3WClIN8y/AZYHhiY8HtjPFke4OGY2Z9dsGlt1yz58eJvBDb:pJI5q/0YHhGNjPFx4OGzvssteRJvtb
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-