Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
c81067a2bd494fd599d348faf5525e20.exe
-
Size
773KB
-
Sample
230310-je84vacb97
-
MD5
c81067a2bd494fd599d348faf5525e20
-
SHA1
8d0c9c5a989119a6274e0a0ccadd3967355e1792
-
SHA256
d8525593464fd57668aa86ee583452f5db36c7d55583252837072d3c1e54da47
-
SHA512
2ba558a5852f3527c1dc454add20caca62ed9742c2dccf8025b7445495a2cfaa1c61c195a6b50c0600ac73f47f24446e5490df112dc5d7b273f4250438095c91
-
SSDEEP
12288:8AZN5Bv30aX6nqtNl7BAmsRhUFjeTIEhhyFTIP2qVpZfxOFyrMxS6DVT:9N5Bv30a1l7StedeKGPnVPoS6DVT
Static task
static1
Behavioral task
behavioral1
Sample
c81067a2bd494fd599d348faf5525e20.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
c81067a2bd494fd599d348faf5525e20.exe
Resource
win10v2004-20230220-en
Malware Config
Extracted
redline
dezik
193.56.146.220:4174
-
auth_value
d39f21dca8edc10800b036ab83f4d75e
Extracted
amadey
3.68
31.41.244.200/games/category/index.php
Targets
-
-
Target
c81067a2bd494fd599d348faf5525e20.exe
-
Size
773KB
-
MD5
c81067a2bd494fd599d348faf5525e20
-
SHA1
8d0c9c5a989119a6274e0a0ccadd3967355e1792
-
SHA256
d8525593464fd57668aa86ee583452f5db36c7d55583252837072d3c1e54da47
-
SHA512
2ba558a5852f3527c1dc454add20caca62ed9742c2dccf8025b7445495a2cfaa1c61c195a6b50c0600ac73f47f24446e5490df112dc5d7b273f4250438095c91
-
SSDEEP
12288:8AZN5Bv30aX6nqtNl7BAmsRhUFjeTIEhhyFTIP2qVpZfxOFyrMxS6DVT:9N5Bv30a1l7StedeKGPnVPoS6DVT
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-