Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
9296e761af1c81681bec18fac3aa28a1.exe
-
Size
1.0MB
-
Sample
230425-adq27sfd37
-
MD5
9296e761af1c81681bec18fac3aa28a1
-
SHA1
4922a6aaeaf06487987bc9c61f549e65ac1f7c3f
-
SHA256
0674bd5e0f40dfbfa7186f3d36da8f5cd9b86ca04625b3db609879bb7734c237
-
SHA512
e27b065d4921454668f4be39b99caa32b9dc3e689d209551362cf4330b10070595e56385f80bff2658318669799421ac9a42488440aa6da5ca7fb5618be8f66a
-
SSDEEP
24576:9yUNj1aELymFZS82gDOXnSFKbreNPRWR2FWX0OFTt6Lp7H:YUREqZS826ASFKbrytFO0OFTM
Static task
static1
Behavioral task
behavioral1
Sample
9296e761af1c81681bec18fac3aa28a1.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
9296e761af1c81681bec18fac3aa28a1.exe
Resource
win10v2004-20230220-en
Malware Config
Extracted
amadey
3.70
212.113.119.255/joomla/index.php
Extracted
redline
Heaven
103.161.170.185:33621
-
auth_value
0dbeabaddb415a98dbde3a27af173ac5
Targets
-
-
Target
9296e761af1c81681bec18fac3aa28a1.exe
-
Size
1.0MB
-
MD5
9296e761af1c81681bec18fac3aa28a1
-
SHA1
4922a6aaeaf06487987bc9c61f549e65ac1f7c3f
-
SHA256
0674bd5e0f40dfbfa7186f3d36da8f5cd9b86ca04625b3db609879bb7734c237
-
SHA512
e27b065d4921454668f4be39b99caa32b9dc3e689d209551362cf4330b10070595e56385f80bff2658318669799421ac9a42488440aa6da5ca7fb5618be8f66a
-
SSDEEP
24576:9yUNj1aELymFZS82gDOXnSFKbreNPRWR2FWX0OFTt6Lp7H:YUREqZS826ASFKbrytFO0OFTM
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Downloads MZ/PE file
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2
-