Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
ecd6e28300049668d77c4518286ee62df560cd94068b81595987cdebd49b0599
-
Size
565KB
-
Sample
230503-z8qglagf45
-
MD5
a34b6a66f18e783517f71360599f9076
-
SHA1
fcca4a790ed34780ec97996529adbe214b02b743
-
SHA256
ecd6e28300049668d77c4518286ee62df560cd94068b81595987cdebd49b0599
-
SHA512
6c18bd0f1a13405f10d221f911eabc7543f3572163ff69175b49121a95b533c9614e168bfb57d112c4ddb9ab400f4150080adaaa473077eb1ed50ee386cb0455
-
SSDEEP
12288:dMr3y903KT2GvJxdCsrYgsJbHzuwcCPhhmw8y:WytfJLCskFJrzuwcCJx
Static task
static1
Behavioral task
behavioral1
Sample
ecd6e28300049668d77c4518286ee62df560cd94068b81595987cdebd49b0599.exe
Resource
win10-20230220-en
Malware Config
Extracted
redline
darm
217.196.96.56:4138
-
auth_value
d88ac8ccc04ab9979b04b46313db1648
Targets
-
-
Target
ecd6e28300049668d77c4518286ee62df560cd94068b81595987cdebd49b0599
-
Size
565KB
-
MD5
a34b6a66f18e783517f71360599f9076
-
SHA1
fcca4a790ed34780ec97996529adbe214b02b743
-
SHA256
ecd6e28300049668d77c4518286ee62df560cd94068b81595987cdebd49b0599
-
SHA512
6c18bd0f1a13405f10d221f911eabc7543f3572163ff69175b49121a95b533c9614e168bfb57d112c4ddb9ab400f4150080adaaa473077eb1ed50ee386cb0455
-
SSDEEP
12288:dMr3y903KT2GvJxdCsrYgsJbHzuwcCPhhmw8y:WytfJLCskFJrzuwcCJx
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Executes dropped EXE
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-