Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
9f5cd5834b87274b9d0bde0b4c1dbd2ea2b144084a8fbcc910a4262851a48eff
-
Size
459KB
-
Sample
230312-h357esfb7v
-
MD5
86655f7893da5dcd3348b097154b6091
-
SHA1
7ec2a66117af034b39b764c5d16817fc832b9fad
-
SHA256
9f5cd5834b87274b9d0bde0b4c1dbd2ea2b144084a8fbcc910a4262851a48eff
-
SHA512
12aa7ad6a21bce679b9088874aae8983da92834b2f4c0cc551abc3b23c42e98a5a8476b87848cb88689fd4c38cb67d9bba4a087d88474112a52fb4e0e4cb5df7
-
SSDEEP
12288:JxFGgNXEsffo5TwN8srb5ZisaL86eb36y2R:J+s0sIdwKSXi/L8rKy2R
Static task
static1
Behavioral task
behavioral1
Sample
9f5cd5834b87274b9d0bde0b4c1dbd2ea2b144084a8fbcc910a4262851a48eff.exe
Resource
win10v2004-20230220-en
Malware Config
Extracted
redline
well
193.233.20.28:4125
-
auth_value
265e7373dd436339d88347c08a10b402
Extracted
amadey
3.68
31.41.244.200/games/category/index.php
Targets
-
-
Target
9f5cd5834b87274b9d0bde0b4c1dbd2ea2b144084a8fbcc910a4262851a48eff
-
Size
459KB
-
MD5
86655f7893da5dcd3348b097154b6091
-
SHA1
7ec2a66117af034b39b764c5d16817fc832b9fad
-
SHA256
9f5cd5834b87274b9d0bde0b4c1dbd2ea2b144084a8fbcc910a4262851a48eff
-
SHA512
12aa7ad6a21bce679b9088874aae8983da92834b2f4c0cc551abc3b23c42e98a5a8476b87848cb88689fd4c38cb67d9bba4a087d88474112a52fb4e0e4cb5df7
-
SSDEEP
12288:JxFGgNXEsffo5TwN8srb5ZisaL86eb36y2R:J+s0sIdwKSXi/L8rKy2R
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-