Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
da57f6e3bc73b68a801266fc6db4688574dea4324885c041ea6530da472888b5
-
Size
1.1MB
-
Sample
230411-wr8easfg6z
-
MD5
01bb432f7829899113a28f136aa246f1
-
SHA1
8cf42f9f1f1a4bda9b6030fa167bc4178795600e
-
SHA256
da57f6e3bc73b68a801266fc6db4688574dea4324885c041ea6530da472888b5
-
SHA512
38d130046d19ee97d818e8219795b6c71eca03a3dabf1457cb78fca3777355900a613965c4c219ae4ce2f6474d4d5872bcdbe29609d8509ec2c3a0b3cd21b25b
-
SSDEEP
24576:kyJqE6VQqh0t9p6ILUzF6wzVvxpk+fnP+cyRnJO5H0iExz:zFqmoILUpPPpkeP+VnE5HC
Static task
static1
Malware Config
Extracted
redline
lada
185.161.248.90:4125
-
auth_value
0b3678897547fedafe314eda5a2015ba
Extracted
amadey
3.70
193.201.9.43/plays/chapter/index.php
Extracted
redline
maxi
185.161.248.90:4125
-
auth_value
6a3f22e5f4209b056a3fd330dc71956a
Targets
-
-
Target
da57f6e3bc73b68a801266fc6db4688574dea4324885c041ea6530da472888b5
-
Size
1.1MB
-
MD5
01bb432f7829899113a28f136aa246f1
-
SHA1
8cf42f9f1f1a4bda9b6030fa167bc4178795600e
-
SHA256
da57f6e3bc73b68a801266fc6db4688574dea4324885c041ea6530da472888b5
-
SHA512
38d130046d19ee97d818e8219795b6c71eca03a3dabf1457cb78fca3777355900a613965c4c219ae4ce2f6474d4d5872bcdbe29609d8509ec2c3a0b3cd21b25b
-
SSDEEP
24576:kyJqE6VQqh0t9p6ILUzF6wzVvxpk+fnP+cyRnJO5H0iExz:zFqmoILUpPPpkeP+VnE5HC
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-