Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
6f8aea76cc359574c85acb4db8c24ee2945ff16f888aa5ae4685374499e71d90
-
Size
479KB
-
Sample
230506-rltlqshe63
-
MD5
a2361f345c8ff29b20280e4de83b16e3
-
SHA1
46bbe53e3f318ee1680922619ec3a439f886f694
-
SHA256
6f8aea76cc359574c85acb4db8c24ee2945ff16f888aa5ae4685374499e71d90
-
SHA512
6a7cea6f84b236b2dc22ff705d09328bf78298a3ed921b77bfd342971b7d047b4fc3c67d8be001110cc92d9240ed60042b7da866845df76340b433e640c1233a
-
SSDEEP
6144:K3y+bnr+qp0yN90QEYFbihAv/dZdbP5hdyzLt8JyfFo4noiF/AvwNT6OpzaClpi5:dMriy90KbsAvV5Xw8w5nJNWOpzF+qmX
Static task
static1
Behavioral task
behavioral1
Sample
6f8aea76cc359574c85acb4db8c24ee2945ff16f888aa5ae4685374499e71d90.exe
Resource
win10v2004-20230220-en
Malware Config
Extracted
redline
dariy
217.196.96.101:4132
-
auth_value
2f34aa0d1cb1023a826825b68ebedcc8
Targets
-
-
Target
6f8aea76cc359574c85acb4db8c24ee2945ff16f888aa5ae4685374499e71d90
-
Size
479KB
-
MD5
a2361f345c8ff29b20280e4de83b16e3
-
SHA1
46bbe53e3f318ee1680922619ec3a439f886f694
-
SHA256
6f8aea76cc359574c85acb4db8c24ee2945ff16f888aa5ae4685374499e71d90
-
SHA512
6a7cea6f84b236b2dc22ff705d09328bf78298a3ed921b77bfd342971b7d047b4fc3c67d8be001110cc92d9240ed60042b7da866845df76340b433e640c1233a
-
SSDEEP
6144:K3y+bnr+qp0yN90QEYFbihAv/dZdbP5hdyzLt8JyfFo4noiF/AvwNT6OpzaClpi5:dMriy90KbsAvV5Xw8w5nJNWOpzF+qmX
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-