Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

1829a5dd1d...41.exe

windows7-x64

10

1829a5dd1d...41.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1829a5dd1d03551301cf09b9abd29ffc6c44b01013ad87d5d799cf68a70d9741.bin

  • Size

    1.1MB

  • Sample

    230506-zgj6hacf64

  • MD5

    f2adf4b605725d212f9d023d26a264a7

  • SHA1

    d9302b1fc151cc54d954a1b4e1378c9e8cff2547

  • SHA256

    1829a5dd1d03551301cf09b9abd29ffc6c44b01013ad87d5d799cf68a70d9741

  • SHA512

    4855804737dc21e5c6ac3c4de73b4fe470bf4f5dc54e5693735373fa4bf9fef233a8b15131e57f9e658327d19809c337c189e9121e0bea4141b65852817f4d45

  • SSDEEP

    12288:7y90YMVFIGWYS/YPNStmmW7aytAOC2fSjg/J9OlojOixqD3ZPyq75OvmpRbvMYRn:7yzZGzMtmmW7rpxOix23ZqqXdRgtk

Score
10/10
redlineevasioninfostealerpersistencestealertrojan

Malware Config

Targets

    • Target

      1829a5dd1d03551301cf09b9abd29ffc6c44b01013ad87d5d799cf68a70d9741.bin

    • Size

      1.1MB

    • MD5

      f2adf4b605725d212f9d023d26a264a7

    • SHA1

      d9302b1fc151cc54d954a1b4e1378c9e8cff2547

    • SHA256

      1829a5dd1d03551301cf09b9abd29ffc6c44b01013ad87d5d799cf68a70d9741

    • SHA512

      4855804737dc21e5c6ac3c4de73b4fe470bf4f5dc54e5693735373fa4bf9fef233a8b15131e57f9e658327d19809c337c189e9121e0bea4141b65852817f4d45

    • SSDEEP

      12288:7y90YMVFIGWYS/YPNStmmW7aytAOC2fSjg/J9OlojOixqD3ZPyq75OvmpRbvMYRn:7yzZGzMtmmW7rpxOix23ZqqXdRgtk

    Score
    10/10
    evasionpersistencetrojanredlineinfostealerstealer

    • Detects Redline Stealer samples

      This rule detects the presence of Redline Stealer samples based on their unique strings.

      stealer

    • Modifies Windows Defender Real-time Protection settings

      evasiontrojan

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Windows security modification

      evasiontrojan

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks