Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
6eb8db73620408ebc3d1cc5c3aa67012c6d9b5a63ac23b5dffe4a847505ad286
-
Size
1018KB
-
Sample
230321-ntt1paaa76
-
MD5
81bac0d106488a7c53aabfae9da1b59f
-
SHA1
f65c67a89b61deed0aa360a52c1c3f128e1943fa
-
SHA256
6eb8db73620408ebc3d1cc5c3aa67012c6d9b5a63ac23b5dffe4a847505ad286
-
SHA512
7e2706fd3a3c54659d063ac3ac9a64c3237535070bfe3de4843afc5ee9c5df51ce6cad9e59bd2d3279c9ac51fce0f8eb86283512719e4299df955cb2e5864467
-
SSDEEP
24576:myyh6tD4M2Qe8HYX0wvY5iTKG07QYEFdZxMtIj:1yhUk6JoKj7hGjMe
Static task
static1
Malware Config
Extracted
redline
gena
193.233.20.30:4125
-
auth_value
93c20961cb6b06b2d5781c212db6201e
Extracted
redline
vint
193.233.20.30:4125
-
auth_value
fb8811912f8370b3d23bffda092d88d0
Extracted
amadey
3.68
62.204.41.87/joomla/index.php
Targets
-
-
Target
6eb8db73620408ebc3d1cc5c3aa67012c6d9b5a63ac23b5dffe4a847505ad286
-
Size
1018KB
-
MD5
81bac0d106488a7c53aabfae9da1b59f
-
SHA1
f65c67a89b61deed0aa360a52c1c3f128e1943fa
-
SHA256
6eb8db73620408ebc3d1cc5c3aa67012c6d9b5a63ac23b5dffe4a847505ad286
-
SHA512
7e2706fd3a3c54659d063ac3ac9a64c3237535070bfe3de4843afc5ee9c5df51ce6cad9e59bd2d3279c9ac51fce0f8eb86283512719e4299df955cb2e5864467
-
SSDEEP
24576:myyh6tD4M2Qe8HYX0wvY5iTKG07QYEFdZxMtIj:1yhUk6JoKj7hGjMe
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-