Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
839acca14cfb89e6fa72abe4c75c5e51a47aea0bbf269c8a8586e41b82fdf48d
-
Size
1.4MB
-
Sample
230413-npq38scd7t
-
MD5
8d7efdb20dbcb06fa480fbaf24e8c42b
-
SHA1
0c78f9b9dd19fac8eeb8c23f9fe552bc3204fafa
-
SHA256
839acca14cfb89e6fa72abe4c75c5e51a47aea0bbf269c8a8586e41b82fdf48d
-
SHA512
5e60e8c7c0844496af3973b73d24efec859a62a54a17de3037ae464641355350d8f08e9079683edfa76b2c509ae0d41d0c4e8c0f1c673f6c47c7e10e51b47df1
-
SSDEEP
24576:dyppPjIzSN23UciJravswBOgXPA4AzlKO6Gmyk77taozoApDDzavOKORtgZ:4ppP01Macg/+lK8nQXoIDHYO3R
Static task
static1
Malware Config
Extracted
redline
lada
185.161.248.90:4125
-
auth_value
0b3678897547fedafe314eda5a2015ba
Extracted
amadey
3.70
193.201.9.43/plays/chapter/index.php
Extracted
redline
mari
185.161.248.90:4125
-
auth_value
55a059e2793efc70d441ee368eba8733
Targets
-
-
Target
839acca14cfb89e6fa72abe4c75c5e51a47aea0bbf269c8a8586e41b82fdf48d
-
Size
1.4MB
-
MD5
8d7efdb20dbcb06fa480fbaf24e8c42b
-
SHA1
0c78f9b9dd19fac8eeb8c23f9fe552bc3204fafa
-
SHA256
839acca14cfb89e6fa72abe4c75c5e51a47aea0bbf269c8a8586e41b82fdf48d
-
SHA512
5e60e8c7c0844496af3973b73d24efec859a62a54a17de3037ae464641355350d8f08e9079683edfa76b2c509ae0d41d0c4e8c0f1c673f6c47c7e10e51b47df1
-
SSDEEP
24576:dyppPjIzSN23UciJravswBOgXPA4AzlKO6Gmyk77taozoApDDzavOKORtgZ:4ppP01Macg/+lK8nQXoIDHYO3R
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-