Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
fdf9ac0563eaf7e98bc4d8f91c8623af36c2fe8a0180a483fd5e12e860702558
-
Size
682KB
-
Sample
230323-evyktsdd98
-
MD5
12471fd0722fdea2fc99c4f92d9b7549
-
SHA1
34fdd523fc811547550a4cc80956db47850ce1f1
-
SHA256
fdf9ac0563eaf7e98bc4d8f91c8623af36c2fe8a0180a483fd5e12e860702558
-
SHA512
646342a6648ac735cd12eb21cc6f2b0c4732e401086f7d25c91008bb1c8953b7ffc3c06eb1d4e6f95bb0b38bb19c5f1a7e5a27dfd74d04d2e958b5122939d4d7
-
SSDEEP
12288:M/2+N/Arrf2R06BkiV0xyUT6AxqkOivzDLPkh6FwbyK8icKiRGy:MdAfXiCxy66AxqiDWtbyKdFy
Static task
static1
Behavioral task
behavioral1
Sample
fdf9ac0563eaf7e98bc4d8f91c8623af36c2fe8a0180a483fd5e12e860702558.exe
Resource
win10-20230220-en
Malware Config
Extracted
redline
down
193.233.20.31:4125
-
auth_value
12c31a90c72f5efae8c053a0bd339381
Extracted
redline
real
193.233.20.31:4125
-
auth_value
bb22a50228754849387d5f4d1611e71b
Targets
-
-
Target
fdf9ac0563eaf7e98bc4d8f91c8623af36c2fe8a0180a483fd5e12e860702558
-
Size
682KB
-
MD5
12471fd0722fdea2fc99c4f92d9b7549
-
SHA1
34fdd523fc811547550a4cc80956db47850ce1f1
-
SHA256
fdf9ac0563eaf7e98bc4d8f91c8623af36c2fe8a0180a483fd5e12e860702558
-
SHA512
646342a6648ac735cd12eb21cc6f2b0c4732e401086f7d25c91008bb1c8953b7ffc3c06eb1d4e6f95bb0b38bb19c5f1a7e5a27dfd74d04d2e958b5122939d4d7
-
SSDEEP
12288:M/2+N/Arrf2R06BkiV0xyUT6AxqkOivzDLPkh6FwbyK8icKiRGy:MdAfXiCxy66AxqiDWtbyKdFy
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Executes dropped EXE
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-