Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
b5ecf952c2d00fa68b30f4b687ec93438d34c82603e9d317dd6aa76d33cd89ed
-
Size
1.0MB
-
Sample
230316-txnwqsbg83
-
MD5
2963d63c79398c184bf538491fb361aa
-
SHA1
7e8deebe5acea949e456fba012f2872ab9dd8688
-
SHA256
b5ecf952c2d00fa68b30f4b687ec93438d34c82603e9d317dd6aa76d33cd89ed
-
SHA512
e04d05059e7d500c7a2525fd49ec4eb618ea77227fd6a96e123ff85ec7b09d64809e19588ba0b5042e7ee73c981f2a4b488ccf630ce970ddd9155e759b76d411
-
SSDEEP
24576:BFl6d5A2jNkZ31oibVVeTPZpbxAbnxcSp+HXu:4du2ql/B2kbnxt+3
Static task
static1
Malware Config
Extracted
redline
mango
193.233.20.28:4125
-
auth_value
ecf79d7f5227d998a3501c972d915d23
Extracted
redline
rako
193.233.20.28:4125
-
auth_value
69e2d139981e0b037a6786e01a92824d
Extracted
amadey
3.68
31.41.244.200/games/category/index.php
Targets
-
-
Target
b5ecf952c2d00fa68b30f4b687ec93438d34c82603e9d317dd6aa76d33cd89ed
-
Size
1.0MB
-
MD5
2963d63c79398c184bf538491fb361aa
-
SHA1
7e8deebe5acea949e456fba012f2872ab9dd8688
-
SHA256
b5ecf952c2d00fa68b30f4b687ec93438d34c82603e9d317dd6aa76d33cd89ed
-
SHA512
e04d05059e7d500c7a2525fd49ec4eb618ea77227fd6a96e123ff85ec7b09d64809e19588ba0b5042e7ee73c981f2a4b488ccf630ce970ddd9155e759b76d411
-
SSDEEP
24576:BFl6d5A2jNkZ31oibVVeTPZpbxAbnxcSp+HXu:4du2ql/B2kbnxt+3
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Executes dropped EXE
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-