Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

399d14f7c9...66.exe

windows7-x64

10

399d14f7c9...66.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    399d14f7c9be5ad30e51acfa665f5c775083ce147a22b8b4f94184da24494166.bin

  • Size

    1.1MB

  • Sample

    230506-z8wzdahg7x

  • MD5

    f6e5a9f36407f147a911aeea822b0394

  • SHA1

    397f69e04c9626b5c9fa2ff93d4b0ea20c10f418

  • SHA256

    399d14f7c9be5ad30e51acfa665f5c775083ce147a22b8b4f94184da24494166

  • SHA512

    6ec60b0b6c8c07a5d7bc5f8432e7e483ff85a29ef92837f6f36965f846eb9f0cb8f158ef333aa11d5df082de24bb60fd1301346f05e20e565ac25b084cbc79ed

  • SSDEEP

    24576:fyxTCF7yG3TcbjcX2EfYCoAhxVEcTmkSliIFFy7T:qrITQjqtgwhzmEIFFE

Score
10/10
redlineevasioninfostealerpersistencestealertrojan

Malware Config

Targets

    • Target

      399d14f7c9be5ad30e51acfa665f5c775083ce147a22b8b4f94184da24494166.bin

    • Size

      1.1MB

    • MD5

      f6e5a9f36407f147a911aeea822b0394

    • SHA1

      397f69e04c9626b5c9fa2ff93d4b0ea20c10f418

    • SHA256

      399d14f7c9be5ad30e51acfa665f5c775083ce147a22b8b4f94184da24494166

    • SHA512

      6ec60b0b6c8c07a5d7bc5f8432e7e483ff85a29ef92837f6f36965f846eb9f0cb8f158ef333aa11d5df082de24bb60fd1301346f05e20e565ac25b084cbc79ed

    • SSDEEP

      24576:fyxTCF7yG3TcbjcX2EfYCoAhxVEcTmkSliIFFy7T:qrITQjqtgwhzmEIFFE

    Score
    10/10
    evasionpersistencetrojanredlineinfostealerstealer

    • Detects Redline Stealer samples

      This rule detects the presence of Redline Stealer samples based on their unique strings.

      stealer

    • Modifies Windows Defender Real-time Protection settings

      evasiontrojan

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Windows security modification

      evasiontrojan

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks