Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
0c4a39b4890d2abdc2acfa786f522994.exe
-
Size
716KB
-
Sample
230310-lvg2eaed2s
-
MD5
0c4a39b4890d2abdc2acfa786f522994
-
SHA1
f7b2335c378ca0ee6eba06b1acc451571289eafb
-
SHA256
4877e0049163cee65adf9d3b248f48f3415d0468490fa0a185f2a617a0c68ef5
-
SHA512
1e415a972a1098ea61a041ff8c1326eafbcd8c9938b52f27f50cdb87ec95999a51e204925f815ece7d6665cac5d87634a36b001b1c167bc5e3d8f0eb233bd56f
-
SSDEEP
12288:ZkQH4MLTHJ9dj9pi/3TtReM4AreTcrrVGU5k7yDpLD5kNS2U/:R4MnHJ9JK3TtReMa8r0U5iyfkNW
Static task
static1
Behavioral task
behavioral1
Sample
0c4a39b4890d2abdc2acfa786f522994.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
0c4a39b4890d2abdc2acfa786f522994.exe
Resource
win10v2004-20230220-en
Malware Config
Extracted
redline
dezik
193.56.146.220:4174
-
auth_value
d39f21dca8edc10800b036ab83f4d75e
Extracted
amadey
3.68
31.41.244.200/games/category/index.php
Targets
-
-
Target
0c4a39b4890d2abdc2acfa786f522994.exe
-
Size
716KB
-
MD5
0c4a39b4890d2abdc2acfa786f522994
-
SHA1
f7b2335c378ca0ee6eba06b1acc451571289eafb
-
SHA256
4877e0049163cee65adf9d3b248f48f3415d0468490fa0a185f2a617a0c68ef5
-
SHA512
1e415a972a1098ea61a041ff8c1326eafbcd8c9938b52f27f50cdb87ec95999a51e204925f815ece7d6665cac5d87634a36b001b1c167bc5e3d8f0eb233bd56f
-
SSDEEP
12288:ZkQH4MLTHJ9dj9pi/3TtReM4AreTcrrVGU5k7yDpLD5kNS2U/:R4MnHJ9JK3TtReMa8r0U5iyfkNW
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-