Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
8636bfa8ffc9df2512ca2147164baef4d542202bf15025a19c36be7526126e1a
-
Size
720KB
-
Sample
230325-v29jnsdf95
-
MD5
f603831bcdb6dab29e5231ee6b0d8c59
-
SHA1
e71f49d34f7eba94d86597cf6f886cec597e0d3b
-
SHA256
8636bfa8ffc9df2512ca2147164baef4d542202bf15025a19c36be7526126e1a
-
SHA512
f6563489859f0dfcf453b6cc744efdfa646e18bc834cb9f1141148ce8528616f33ea7d9de1196b6f5a1bcfdd633497504efd0c1655815f3f8fdcc93669fb46fe
-
SSDEEP
12288:DLrfxjYSBIeOllQw61Lt8xOWHF1GM12zDN9YolbvALA505LiBMTHo/922xOJFIu:DLSS3ob1hYP3nT6FMU2xE3
Static task
static1
Behavioral task
behavioral1
Sample
8636bfa8ffc9df2512ca2147164baef4d542202bf15025a19c36be7526126e1a.exe
Resource
win10-20230220-en
Malware Config
Extracted
redline
boris
193.233.20.32:4125
-
auth_value
766b5bdf6dbefcf7ca223351952fc38f
Extracted
redline
viza
193.233.20.32:4125
-
auth_value
153a106a89fae7251f2dc17be2eb5720
Targets
-
-
Target
8636bfa8ffc9df2512ca2147164baef4d542202bf15025a19c36be7526126e1a
-
Size
720KB
-
MD5
f603831bcdb6dab29e5231ee6b0d8c59
-
SHA1
e71f49d34f7eba94d86597cf6f886cec597e0d3b
-
SHA256
8636bfa8ffc9df2512ca2147164baef4d542202bf15025a19c36be7526126e1a
-
SHA512
f6563489859f0dfcf453b6cc744efdfa646e18bc834cb9f1141148ce8528616f33ea7d9de1196b6f5a1bcfdd633497504efd0c1655815f3f8fdcc93669fb46fe
-
SSDEEP
12288:DLrfxjYSBIeOllQw61Lt8xOWHF1GM12zDN9YolbvALA505LiBMTHo/922xOJFIu:DLSS3ob1hYP3nT6FMU2xE3
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Executes dropped EXE
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-