Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
a7ec3a10a384cb025f1e713a8b5dd02b102d81a1a3e30b15d179005bb7f8beb7
-
Size
696KB
-
Sample
230328-rszrbsdb8v
-
MD5
68312da8ca407cd678c46dc16a19510b
-
SHA1
f3762c36d0c3dfcc98261c39dcd16f0409f39d1a
-
SHA256
a7ec3a10a384cb025f1e713a8b5dd02b102d81a1a3e30b15d179005bb7f8beb7
-
SHA512
74226473df76c21292ce9ac37b73e45560ce382640a7f8a452b1bc9d42a8b205d337bff8ddf945c2b38334c76e0fee78ffd0b49f0185f51d4ec88fae856ddbb1
-
SSDEEP
12288:BMrey90zDh/pj9SQB48NzZaDzfrLy8HO5rFWLtAMI2VDbvZKTrmB0py:jyycunNzZObC8HO5ZWGM1JvbBiy
Static task
static1
Behavioral task
behavioral1
Sample
a7ec3a10a384cb025f1e713a8b5dd02b102d81a1a3e30b15d179005bb7f8beb7.exe
Resource
win10v2004-20230221-en
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
muse
176.113.115.145:4125
-
auth_value
b91988a63a24940038d9262827a5320c
Targets
-
-
Target
a7ec3a10a384cb025f1e713a8b5dd02b102d81a1a3e30b15d179005bb7f8beb7
-
Size
696KB
-
MD5
68312da8ca407cd678c46dc16a19510b
-
SHA1
f3762c36d0c3dfcc98261c39dcd16f0409f39d1a
-
SHA256
a7ec3a10a384cb025f1e713a8b5dd02b102d81a1a3e30b15d179005bb7f8beb7
-
SHA512
74226473df76c21292ce9ac37b73e45560ce382640a7f8a452b1bc9d42a8b205d337bff8ddf945c2b38334c76e0fee78ffd0b49f0185f51d4ec88fae856ddbb1
-
SSDEEP
12288:BMrey90zDh/pj9SQB48NzZaDzfrLy8HO5rFWLtAMI2VDbvZKTrmB0py:jyycunNzZObC8HO5ZWGM1JvbBiy
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Executes dropped EXE
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-