Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
309cc38eb761fc52acbf1d90c938ad08d39b9b5c127220040d368bc3fefda6b6
-
Size
1.0MB
-
Sample
230316-thfa2sdh9t
-
MD5
cf603cdcdb866bfe4f4422f1be6610fb
-
SHA1
88ba8dd33fbe39e9385d89449a5d2cea20f8bf4f
-
SHA256
309cc38eb761fc52acbf1d90c938ad08d39b9b5c127220040d368bc3fefda6b6
-
SHA512
9089d8e649b0329a8ef9afeb4aa63235feff5af57d231256de4995703d8b67ce505b50311fb835f8b01c9a01a077612cdecd6ac14bbfddfaf800447af35e3134
-
SSDEEP
24576:CgHEObseZu44wqJnysRme1JS0Tk6G3rVu+T1/WcZ6:CCb6nyymei0T23U+TRW
Static task
static1
Malware Config
Extracted
redline
mango
193.233.20.28:4125
-
auth_value
ecf79d7f5227d998a3501c972d915d23
Extracted
redline
rako
193.233.20.28:4125
-
auth_value
69e2d139981e0b037a6786e01a92824d
Extracted
amadey
3.68
31.41.244.200/games/category/index.php
Targets
-
-
Target
309cc38eb761fc52acbf1d90c938ad08d39b9b5c127220040d368bc3fefda6b6
-
Size
1.0MB
-
MD5
cf603cdcdb866bfe4f4422f1be6610fb
-
SHA1
88ba8dd33fbe39e9385d89449a5d2cea20f8bf4f
-
SHA256
309cc38eb761fc52acbf1d90c938ad08d39b9b5c127220040d368bc3fefda6b6
-
SHA512
9089d8e649b0329a8ef9afeb4aa63235feff5af57d231256de4995703d8b67ce505b50311fb835f8b01c9a01a077612cdecd6ac14bbfddfaf800447af35e3134
-
SSDEEP
24576:CgHEObseZu44wqJnysRme1JS0Tk6G3rVu+T1/WcZ6:CCb6nyymei0T23U+TRW
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-