Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
c6326212f846c43fd017ae3ecd6e7f4d.bin
-
Size
1.2MB
-
Sample
230506-dsqlrsaa71
-
MD5
5157ebad8df6f3718ec9f9902b276f17
-
SHA1
dc5a3e79bdf99628eec9eba696e75e370502846b
-
SHA256
be9885913c63b467e102d7650841bd56dc038e4d347c7823fe78c8205917cc2d
-
SHA512
32d4cb12b9fd72fcda1f23782da5c4baf70b43663ef456a3bc959a27ccb382b1a5baeb9fe224b7f9bbb4ce184bbd308e69c309535a97e61a48f4b58f9517e265
-
SSDEEP
24576:pz6oYtbFzhY6pMywRLaXw1hPZZVuHgPoY5W:p2oWdY6pMywdaOP2gQR
Static task
static1
Behavioral task
behavioral1
Sample
00f0216950a0e1670937a7e76d2328226792363edc980aedda2de8722ace0896.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
00f0216950a0e1670937a7e76d2328226792363edc980aedda2de8722ace0896.exe
Resource
win10v2004-20230220-en
Malware Config
Extracted
redline
boom
217.196.96.56:4138
-
auth_value
1ce6aebe15bac07a7bc88b114bc49335
Extracted
amadey
3.70
212.113.119.255/joomla/index.php
Targets
-
-
Target
00f0216950a0e1670937a7e76d2328226792363edc980aedda2de8722ace0896.exe
-
Size
1.3MB
-
MD5
c6326212f846c43fd017ae3ecd6e7f4d
-
SHA1
c92d9d6a4df83cd701ab170209a3af9d381ca928
-
SHA256
00f0216950a0e1670937a7e76d2328226792363edc980aedda2de8722ace0896
-
SHA512
fd0d59818687ecebec17820d63bcb61c0e0a4a5253899439e311e0f431234abf22f22cfc88de7801e5c5d95392b9da1e331bf43cfc15a406381fb4b02cbb6268
-
SSDEEP
24576:1yV1s8yRxwV7JGccW9Uan8Ax+dAuQ52W0oIw0A8IZ:Q3s8yRUJGccYUa/yV8x0oIwE
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-