Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
207d96a3f74b6234156483342ad7909ada2ce20980a020f22eec5901781f7ff0
-
Size
1.2MB
-
Sample
230316-ezn7ysbc3z
-
MD5
1ccb0e957964dde0c6e4ab1f5aee4937
-
SHA1
8d0cb7847a4aa4458b1ac9ed2eec4aed77acc411
-
SHA256
207d96a3f74b6234156483342ad7909ada2ce20980a020f22eec5901781f7ff0
-
SHA512
5b6dfec98c5b01b8acc6a13e0b1b23aa2eae00dada842aaee9012c5372f76744e6a0be9bb87b7409b9a5881786b35a171cdaff02d1ef9a38aea77929e0c161c5
-
SSDEEP
24576:u+6rGcx+SsQL1Biudmjpq5SEJ4+YLMSItf++HGKt1fTX/ySV8w:u7GcVL1LaMSEJ6gr9++HG4x
Static task
static1
Malware Config
Extracted
redline
mango
193.233.20.28:4125
-
auth_value
ecf79d7f5227d998a3501c972d915d23
Extracted
redline
sito
193.233.20.28:4125
-
auth_value
030f94d8e396dbe51ce339b815cdad17
Extracted
amadey
3.68
31.41.244.200/games/category/index.php
Targets
-
-
Target
207d96a3f74b6234156483342ad7909ada2ce20980a020f22eec5901781f7ff0
-
Size
1.2MB
-
MD5
1ccb0e957964dde0c6e4ab1f5aee4937
-
SHA1
8d0cb7847a4aa4458b1ac9ed2eec4aed77acc411
-
SHA256
207d96a3f74b6234156483342ad7909ada2ce20980a020f22eec5901781f7ff0
-
SHA512
5b6dfec98c5b01b8acc6a13e0b1b23aa2eae00dada842aaee9012c5372f76744e6a0be9bb87b7409b9a5881786b35a171cdaff02d1ef9a38aea77929e0c161c5
-
SSDEEP
24576:u+6rGcx+SsQL1Biudmjpq5SEJ4+YLMSItf++HGKt1fTX/ySV8w:u7GcVL1LaMSEJ6gr9++HG4x
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-