Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
6365de14d9d67f271f4d4619dacbfa2d044849bda0d8455b8bedab088858f803
-
Size
716KB
-
Sample
230310-h99s7acb64
-
MD5
f4eaf70f345f39838cc38f33e42bd278
-
SHA1
07e352fb0d12cd4ad913902025d83dbbaeffc213
-
SHA256
6365de14d9d67f271f4d4619dacbfa2d044849bda0d8455b8bedab088858f803
-
SHA512
62d16d4aa5a6befa7ed0cb21cdf78f804d594b91f671d4f32a38cf612bee73f1c28644ffda0d15c2ce5e18ef79dfe50b83e40d62c42de89bd4ae4035b85eaaaa
-
SSDEEP
12288:ukQH4MLTHJ9dj9pi/3TtReM4AreTcrrVGU5k7yDpLD5kNS2U/:k4MnHJ9JK3TtReMa8r0U5iyfkNW
Static task
static1
Behavioral task
behavioral1
Sample
6365de14d9d67f271f4d4619dacbfa2d044849bda0d8455b8bedab088858f803.exe
Resource
win10v2004-20230220-en
Malware Config
Extracted
redline
dezik
193.56.146.220:4174
-
auth_value
d39f21dca8edc10800b036ab83f4d75e
Extracted
amadey
3.68
31.41.244.200/games/category/index.php
Targets
-
-
Target
6365de14d9d67f271f4d4619dacbfa2d044849bda0d8455b8bedab088858f803
-
Size
716KB
-
MD5
f4eaf70f345f39838cc38f33e42bd278
-
SHA1
07e352fb0d12cd4ad913902025d83dbbaeffc213
-
SHA256
6365de14d9d67f271f4d4619dacbfa2d044849bda0d8455b8bedab088858f803
-
SHA512
62d16d4aa5a6befa7ed0cb21cdf78f804d594b91f671d4f32a38cf612bee73f1c28644ffda0d15c2ce5e18ef79dfe50b83e40d62c42de89bd4ae4035b85eaaaa
-
SSDEEP
12288:ukQH4MLTHJ9dj9pi/3TtReM4AreTcrrVGU5k7yDpLD5kNS2U/:k4MnHJ9JK3TtReMa8r0U5iyfkNW
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-