Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
a4da2061375d33c65a720992eec6223eb18896c58cd320fcf154212a761ffe46
-
Size
854KB
-
Sample
230411-3pxcksgb73
-
MD5
4adf04e73419da6d0db79807c9121af9
-
SHA1
0931fb3d8d8237aea3ff9be87622e2d1a1e01839
-
SHA256
a4da2061375d33c65a720992eec6223eb18896c58cd320fcf154212a761ffe46
-
SHA512
a2c6b393e949b9f0acf3864b268dab7c74edf02b1dcff56a830a50137892df85a606d77b77effa4e48e1fd1def6954061bceaa28641f6b0775112c9a5eb0810c
-
SSDEEP
24576:Zy201eR4IxFiYNLs3+vvMgMH6V9RhLzVC:M9ejlu+vdMaV97
Static task
static1
Malware Config
Extracted
redline
lada
185.161.248.90:4125
-
auth_value
0b3678897547fedafe314eda5a2015ba
Extracted
redline
diza
185.161.248.90:4125
-
auth_value
0d09b419c8bc967f91c68be4a17e92ee
Extracted
amadey
3.70
193.201.9.43/plays/chapter/index.php
Targets
-
-
Target
a4da2061375d33c65a720992eec6223eb18896c58cd320fcf154212a761ffe46
-
Size
854KB
-
MD5
4adf04e73419da6d0db79807c9121af9
-
SHA1
0931fb3d8d8237aea3ff9be87622e2d1a1e01839
-
SHA256
a4da2061375d33c65a720992eec6223eb18896c58cd320fcf154212a761ffe46
-
SHA512
a2c6b393e949b9f0acf3864b268dab7c74edf02b1dcff56a830a50137892df85a606d77b77effa4e48e1fd1def6954061bceaa28641f6b0775112c9a5eb0810c
-
SSDEEP
24576:Zy201eR4IxFiYNLs3+vvMgMH6V9RhLzVC:M9ejlu+vdMaV97
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-