Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
29dc6b77d056d742412625847cc54c1630a874a67907dcb8c0916c6a4ea4ab61
-
Size
925KB
-
Sample
230411-dxm2fabg3v
-
MD5
42970d83678a8e9126606938cc540a0d
-
SHA1
b22a7f75a93ca56613048e430fefbac860947231
-
SHA256
29dc6b77d056d742412625847cc54c1630a874a67907dcb8c0916c6a4ea4ab61
-
SHA512
d90d60237250afd0d2f9cb880b00459908836593681e8d75dc25772915ea8da93492524d1294fe1e935198ff32bfd6deb102087f8c22c1a249902fe8de646dbf
-
SSDEEP
24576:Tyy4E0G8nt6CWz4OEydpGddIMPyr9o+ow:myUpizZnG8a
Static task
static1
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
nahui
176.113.115.145:4125
-
auth_value
b9ed10946d21e28d58d0c72c535cde6f
Targets
-
-
Target
29dc6b77d056d742412625847cc54c1630a874a67907dcb8c0916c6a4ea4ab61
-
Size
925KB
-
MD5
42970d83678a8e9126606938cc540a0d
-
SHA1
b22a7f75a93ca56613048e430fefbac860947231
-
SHA256
29dc6b77d056d742412625847cc54c1630a874a67907dcb8c0916c6a4ea4ab61
-
SHA512
d90d60237250afd0d2f9cb880b00459908836593681e8d75dc25772915ea8da93492524d1294fe1e935198ff32bfd6deb102087f8c22c1a249902fe8de646dbf
-
SSDEEP
24576:Tyy4E0G8nt6CWz4OEydpGddIMPyr9o+ow:myUpizZnG8a
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-