Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
022c27f86aa558238779f845d37c99c679c3fc9f9cea29dd0085c5ea0cff8ff3
-
Size
689KB
-
Sample
230325-flvy1sbc52
-
MD5
0a612962532d584de9a864f10ac2a90f
-
SHA1
ba39a525f24302bbf745f541dd01c71d60a6a015
-
SHA256
022c27f86aa558238779f845d37c99c679c3fc9f9cea29dd0085c5ea0cff8ff3
-
SHA512
1d36499e1b4fbc9e062147496496dcab954ccadc884e326c68365b5d355d2e321ee6a956faa3ad4e04f572f2a72cb350af0ea93340b78708ac1846034a2f1972
-
SSDEEP
12288:UMrOy90RgPXFXdCW7UwW9BI4VVmdpSwiyYYsdEz5l43xNYMfKb/asLFv8H:iyNBoW7UR9/mKwiCsg5l4hGMSzr0H
Static task
static1
Behavioral task
behavioral1
Sample
022c27f86aa558238779f845d37c99c679c3fc9f9cea29dd0085c5ea0cff8ff3.exe
Resource
win10-20230220-en
Malware Config
Extracted
redline
boris
193.233.20.32:4125
-
auth_value
766b5bdf6dbefcf7ca223351952fc38f
Extracted
redline
lenka
193.233.20.32:4125
-
auth_value
8a60e8b2ec79d6a7e92f9feac39b8830
Targets
-
-
Target
022c27f86aa558238779f845d37c99c679c3fc9f9cea29dd0085c5ea0cff8ff3
-
Size
689KB
-
MD5
0a612962532d584de9a864f10ac2a90f
-
SHA1
ba39a525f24302bbf745f541dd01c71d60a6a015
-
SHA256
022c27f86aa558238779f845d37c99c679c3fc9f9cea29dd0085c5ea0cff8ff3
-
SHA512
1d36499e1b4fbc9e062147496496dcab954ccadc884e326c68365b5d355d2e321ee6a956faa3ad4e04f572f2a72cb350af0ea93340b78708ac1846034a2f1972
-
SSDEEP
12288:UMrOy90RgPXFXdCW7UwW9BI4VVmdpSwiyYYsdEz5l43xNYMfKb/asLFv8H:iyNBoW7UR9/mKwiCsg5l4hGMSzr0H
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Executes dropped EXE
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-