Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
9ce40a759603e65a72b71e976cf1305cddd06e56d028988a5e97c02cdb2a8f29
-
Size
1.1MB
-
Sample
230413-lzhthaca5w
-
MD5
f0ae044fe01382ddd427ee4333897531
-
SHA1
3d374703ec4f5c65b7d342608541067ed8ac542c
-
SHA256
9ce40a759603e65a72b71e976cf1305cddd06e56d028988a5e97c02cdb2a8f29
-
SHA512
928a1998699dc74a61b1a9fc0478847d3eb837d6b26286f16557af7e5e989b4087223c325aeaad88cca5b777c4d4d3d88f45165ac4c1abedb28c4bece903d513
-
SSDEEP
24576:dyQBclZLuuKgXhEE+3KBRkJVbWcTKrXZ7El6Njzkk55zY:4IzZgRxRkObZ7bpw+
Static task
static1
Malware Config
Extracted
redline
lada
185.161.248.90:4125
-
auth_value
0b3678897547fedafe314eda5a2015ba
Extracted
redline
diro
185.161.248.90:4125
-
auth_value
ae95bda0dd2e95169886a3a68138568b
Targets
-
-
Target
9ce40a759603e65a72b71e976cf1305cddd06e56d028988a5e97c02cdb2a8f29
-
Size
1.1MB
-
MD5
f0ae044fe01382ddd427ee4333897531
-
SHA1
3d374703ec4f5c65b7d342608541067ed8ac542c
-
SHA256
9ce40a759603e65a72b71e976cf1305cddd06e56d028988a5e97c02cdb2a8f29
-
SHA512
928a1998699dc74a61b1a9fc0478847d3eb837d6b26286f16557af7e5e989b4087223c325aeaad88cca5b777c4d4d3d88f45165ac4c1abedb28c4bece903d513
-
SSDEEP
24576:dyQBclZLuuKgXhEE+3KBRkJVbWcTKrXZ7El6Njzkk55zY:4IzZgRxRkObZ7bpw+
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-