Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
fe5d482592c567fa8044361e6f97179e84876ad394125654538568b49b63904d
-
Size
1.2MB
-
Sample
230318-168e3adh75
-
MD5
95af1de3590db30c286567c8757dc838
-
SHA1
78b49ce7682e52af1e583016398eaae82fe8a7f0
-
SHA256
fe5d482592c567fa8044361e6f97179e84876ad394125654538568b49b63904d
-
SHA512
aab292cbd70b92cd6fa700a2576b1d5f04a5e609b5cac1cbfc11255cb55ef1dbe08a2dc6e3d53cfb541c466875e643bfae97b12b95ef788f260b1bbe6bbff78a
-
SSDEEP
24576:8LdkRpGh0fHRQSSbvuODeV8CBrRiO4rTdTlJr/fYO:mko0vRzSPDARizTlPr
Static task
static1
Behavioral task
behavioral1
Sample
fe5d482592c567fa8044361e6f97179e84876ad394125654538568b49b63904d.exe
Resource
win10v2004-20230220-en
Malware Config
Extracted
redline
relon
193.233.20.30:4125
-
auth_value
17da69809725577b595e217ba006b869
Extracted
amadey
3.68
31.41.244.200/games/category/index.php
Targets
-
-
Target
fe5d482592c567fa8044361e6f97179e84876ad394125654538568b49b63904d
-
Size
1.2MB
-
MD5
95af1de3590db30c286567c8757dc838
-
SHA1
78b49ce7682e52af1e583016398eaae82fe8a7f0
-
SHA256
fe5d482592c567fa8044361e6f97179e84876ad394125654538568b49b63904d
-
SHA512
aab292cbd70b92cd6fa700a2576b1d5f04a5e609b5cac1cbfc11255cb55ef1dbe08a2dc6e3d53cfb541c466875e643bfae97b12b95ef788f260b1bbe6bbff78a
-
SSDEEP
24576:8LdkRpGh0fHRQSSbvuODeV8CBrRiO4rTdTlJr/fYO:mko0vRzSPDARizTlPr
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-