Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
760837296adb493bd050f1091d472bac8df5806ffdd29abf9b46b3633b974ea3
-
Size
686KB
-
Sample
230326-qkjvgaae8y
-
MD5
a0bad2506dc746c54ce680966e86e711
-
SHA1
2c86f266dfa2e6c466559b1aab4c7171845a9acf
-
SHA256
760837296adb493bd050f1091d472bac8df5806ffdd29abf9b46b3633b974ea3
-
SHA512
c4a810a3dd39b79f94fd46c32b9b5e4036603f2336d98afe88ad789ac134beceada5c9764719f13c2247445e44ebce520f0bbbe788e11d6a8f93bdf587f67eb1
-
SSDEEP
12288:+Mryy90CANMWK38iaH7N2Y5FnzV3ZRRyRyMKB96eEvR7JiIPBLT:IysNMWxiWN2AFZ3ZRRy8PoPV
Static task
static1
Behavioral task
behavioral1
Sample
760837296adb493bd050f1091d472bac8df5806ffdd29abf9b46b3633b974ea3.exe
Resource
win10v2004-20230220-en
Malware Config
Extracted
redline
boris
193.233.20.32:4125
-
auth_value
766b5bdf6dbefcf7ca223351952fc38f
Extracted
redline
dogma
193.233.20.32:4125
-
auth_value
1b692976ca991040f2e8890409c35142
Targets
-
-
Target
760837296adb493bd050f1091d472bac8df5806ffdd29abf9b46b3633b974ea3
-
Size
686KB
-
MD5
a0bad2506dc746c54ce680966e86e711
-
SHA1
2c86f266dfa2e6c466559b1aab4c7171845a9acf
-
SHA256
760837296adb493bd050f1091d472bac8df5806ffdd29abf9b46b3633b974ea3
-
SHA512
c4a810a3dd39b79f94fd46c32b9b5e4036603f2336d98afe88ad789ac134beceada5c9764719f13c2247445e44ebce520f0bbbe788e11d6a8f93bdf587f67eb1
-
SSDEEP
12288:+Mryy90CANMWK38iaH7N2Y5FnzV3ZRRyRyMKB96eEvR7JiIPBLT:IysNMWxiWN2AFZ3ZRRy8PoPV
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Executes dropped EXE
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-