Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
89942c3e51397072722225283650250c1244ac0201db45c795685b3bb2bc52e6
-
Size
683KB
-
Sample
230327-ax3v4sag23
-
MD5
84f5fb9df449978d540e1bfb39df93ed
-
SHA1
3dc0d24b02920bd8ebccaea30d99029a47a50e4f
-
SHA256
89942c3e51397072722225283650250c1244ac0201db45c795685b3bb2bc52e6
-
SHA512
163bc41995e60a761d2c2b9149057e6e23d262a5dd6a5f69477a5e84ded7a199aa8e33e831560fa76353a2330a149bc6959d7710abeac938e06442d67a4696ec
-
SSDEEP
12288:5Mr5y90AqqAjVN2kYpdeudvQNr+vCb1YIpB1+qbwiS0n2UqEWntm6x:QybqquN2kYacvQt+v6b1BbM0n2UqEWnX
Static task
static1
Behavioral task
behavioral1
Sample
89942c3e51397072722225283650250c1244ac0201db45c795685b3bb2bc52e6.exe
Resource
win10v2004-20230220-en
Malware Config
Extracted
redline
sony
193.233.20.33:4125
-
auth_value
1d93d1744381eeb4fcfd7c23ffe0f0b4
Extracted
redline
dent
193.233.20.33:4125
-
auth_value
e795368557f02e28e8aef6bcb279a3b0
Targets
-
-
Target
89942c3e51397072722225283650250c1244ac0201db45c795685b3bb2bc52e6
-
Size
683KB
-
MD5
84f5fb9df449978d540e1bfb39df93ed
-
SHA1
3dc0d24b02920bd8ebccaea30d99029a47a50e4f
-
SHA256
89942c3e51397072722225283650250c1244ac0201db45c795685b3bb2bc52e6
-
SHA512
163bc41995e60a761d2c2b9149057e6e23d262a5dd6a5f69477a5e84ded7a199aa8e33e831560fa76353a2330a149bc6959d7710abeac938e06442d67a4696ec
-
SSDEEP
12288:5Mr5y90AqqAjVN2kYpdeudvQNr+vCb1YIpB1+qbwiS0n2UqEWntm6x:QybqquN2kYacvQt+v6b1BbM0n2UqEWnX
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Executes dropped EXE
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-