Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
8a93952c93239da6adbc952efbaa43ed09121cf3feeb88887c942e9b0602922d
-
Size
466KB
-
Sample
230311-kxjscaah4z
-
MD5
930afb325b17007278c4018b853a869a
-
SHA1
fe504601c685e5427ed25f572f7b59b54cbe9705
-
SHA256
8a93952c93239da6adbc952efbaa43ed09121cf3feeb88887c942e9b0602922d
-
SHA512
818b666ac072bc5a0bbe8564dc664f266abf30ccee8f879394dad52527f8f36d7e9468e63212c48e93ab31ef7f1f0993befd90efc1ccfcb8bb4584bf208bca9a
-
SSDEEP
12288:QOkJkS+rZ+kozHYS9KYH/7zr9lnyNJ07:Q8cES9KYH/7zrryvi
Static task
static1
Behavioral task
behavioral1
Sample
8a93952c93239da6adbc952efbaa43ed09121cf3feeb88887c942e9b0602922d.exe
Resource
win10v2004-20230220-en
Malware Config
Extracted
redline
dezik
193.56.146.220:4174
-
auth_value
d39f21dca8edc10800b036ab83f4d75e
Extracted
amadey
3.68
31.41.244.200/games/category/index.php
Targets
-
-
Target
8a93952c93239da6adbc952efbaa43ed09121cf3feeb88887c942e9b0602922d
-
Size
466KB
-
MD5
930afb325b17007278c4018b853a869a
-
SHA1
fe504601c685e5427ed25f572f7b59b54cbe9705
-
SHA256
8a93952c93239da6adbc952efbaa43ed09121cf3feeb88887c942e9b0602922d
-
SHA512
818b666ac072bc5a0bbe8564dc664f266abf30ccee8f879394dad52527f8f36d7e9468e63212c48e93ab31ef7f1f0993befd90efc1ccfcb8bb4584bf208bca9a
-
SSDEEP
12288:QOkJkS+rZ+kozHYS9KYH/7zr9lnyNJ07:Q8cES9KYH/7zrryvi
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-