Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
5e1649ba5abc77b148231887b23ae90588446a966b6a18c979545c7e2f9d04d3
-
Size
465KB
-
Sample
230310-y4ry7afc24
-
MD5
2fe73d3c6c730a42ee1f68154ca6d479
-
SHA1
2698702d66e280668c9a25b27ce266e5b09d8a47
-
SHA256
5e1649ba5abc77b148231887b23ae90588446a966b6a18c979545c7e2f9d04d3
-
SHA512
f702860df1cd22cca785ddc070c01784a3e463406148b1ee16cd43f0370ed6b5f4172124d8dc94ca2a64e1d0024bf1ed03a67abaf594c8447428f15a7dd8f28c
-
SSDEEP
6144:zFe2WskQALI6KzqjJLKLFCA0k4JzFZUDadKOCRTQoqz6:RxWskQ16UqjJaj74JRCDanCRTQoR
Static task
static1
Behavioral task
behavioral1
Sample
5e1649ba5abc77b148231887b23ae90588446a966b6a18c979545c7e2f9d04d3.exe
Resource
win10v2004-20230220-en
Malware Config
Extracted
redline
dezik
193.56.146.220:4174
-
auth_value
d39f21dca8edc10800b036ab83f4d75e
Extracted
amadey
3.68
31.41.244.200/games/category/index.php
Targets
-
-
Target
5e1649ba5abc77b148231887b23ae90588446a966b6a18c979545c7e2f9d04d3
-
Size
465KB
-
MD5
2fe73d3c6c730a42ee1f68154ca6d479
-
SHA1
2698702d66e280668c9a25b27ce266e5b09d8a47
-
SHA256
5e1649ba5abc77b148231887b23ae90588446a966b6a18c979545c7e2f9d04d3
-
SHA512
f702860df1cd22cca785ddc070c01784a3e463406148b1ee16cd43f0370ed6b5f4172124d8dc94ca2a64e1d0024bf1ed03a67abaf594c8447428f15a7dd8f28c
-
SSDEEP
6144:zFe2WskQALI6KzqjJLKLFCA0k4JzFZUDadKOCRTQoqz6:RxWskQ16UqjJaj74JRCDanCRTQoR
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-