Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
ff56ca12f44f9d87d740f4a54e38f31bb427e20457fd94cf5921fded0a63445a
-
Size
1000KB
-
Sample
230331-ryhp1aee81
-
MD5
fa2bd73beba0a11196f24766f5a63538
-
SHA1
0dd2c16b4de3e14a261cbc6823e4085549cdcc78
-
SHA256
ff56ca12f44f9d87d740f4a54e38f31bb427e20457fd94cf5921fded0a63445a
-
SHA512
22797aabea8b64f35e7f302148ff8c142b233037137351b05d12619d61b8c311047436db2382b1260758760d66bdc5983a2449e69bf39fcabaf3a08e1b6697fd
-
SSDEEP
12288:AMruy90676FOLrPQ4Sarc0yumbQZXADnlVm3rXU4MgzKrImWVxvtWhSXrw1449tr:eyNmUQMZwDu3DU4vGh81wb4vuU+aLG
Static task
static1
Behavioral task
behavioral1
Sample
ff56ca12f44f9d87d740f4a54e38f31bb427e20457fd94cf5921fded0a63445a.exe
Resource
win10v2004-20230220-en
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
lift
176.113.115.145:4125
-
auth_value
94f33c242a83de9dcc729e29ec435dfb
Targets
-
-
Target
ff56ca12f44f9d87d740f4a54e38f31bb427e20457fd94cf5921fded0a63445a
-
Size
1000KB
-
MD5
fa2bd73beba0a11196f24766f5a63538
-
SHA1
0dd2c16b4de3e14a261cbc6823e4085549cdcc78
-
SHA256
ff56ca12f44f9d87d740f4a54e38f31bb427e20457fd94cf5921fded0a63445a
-
SHA512
22797aabea8b64f35e7f302148ff8c142b233037137351b05d12619d61b8c311047436db2382b1260758760d66bdc5983a2449e69bf39fcabaf3a08e1b6697fd
-
SSDEEP
12288:AMruy90676FOLrPQ4Sarc0yumbQZXADnlVm3rXU4MgzKrImWVxvtWhSXrw1449tr:eyNmUQMZwDu3DU4vGh81wb4vuU+aLG
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Executes dropped EXE
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-