Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
7e7758d3bdc70e61d622b111c0ba2a1f61627520facdaa95afcc45efe2f144a0
-
Size
1.3MB
-
Sample
230321-zchrwafa2x
-
MD5
62b5220bdc6089e29f5af3fcfb3a2466
-
SHA1
cda3a193bc38af5a32e910454749efc44080e28e
-
SHA256
7e7758d3bdc70e61d622b111c0ba2a1f61627520facdaa95afcc45efe2f144a0
-
SHA512
560ff710fd3eeaaba4cc3f1bedf87bf477ff595c2d649d49869e89dcc06189946d255c84381aaf1853b792e87ae9189ed1a4f5c0e4fbc423e587e4a665f8e1fa
-
SSDEEP
24576:EnzPcbD/h1btFFh3DEYckeYbP1a3S3zLXGowWuFV3EQ1LQi8Pti/STV88Av:yC/hlVhFcYbw3SjLXGoDuvEQ1LQBtd61
Static task
static1
Malware Config
Extracted
redline
down
193.233.20.31:4125
-
auth_value
12c31a90c72f5efae8c053a0bd339381
Extracted
redline
maxi
193.233.20.30:4125
-
auth_value
6e90da232d4c2e35c1a36c250f5f8904
Extracted
amadey
3.68
31.41.244.200/games/category/index.php
Targets
-
-
Target
7e7758d3bdc70e61d622b111c0ba2a1f61627520facdaa95afcc45efe2f144a0
-
Size
1.3MB
-
MD5
62b5220bdc6089e29f5af3fcfb3a2466
-
SHA1
cda3a193bc38af5a32e910454749efc44080e28e
-
SHA256
7e7758d3bdc70e61d622b111c0ba2a1f61627520facdaa95afcc45efe2f144a0
-
SHA512
560ff710fd3eeaaba4cc3f1bedf87bf477ff595c2d649d49869e89dcc06189946d255c84381aaf1853b792e87ae9189ed1a4f5c0e4fbc423e587e4a665f8e1fa
-
SSDEEP
24576:EnzPcbD/h1btFFh3DEYckeYbP1a3S3zLXGowWuFV3EQ1LQi8Pti/STV88Av:yC/hlVhFcYbw3SjLXGoDuvEQ1LQBtd61
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Executes dropped EXE
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-