Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
1b19d19057572d7b5a8f93c2aab42ee97fad4a2fac315d7f1a29d4f6bcc64abc
-
Size
480KB
-
Sample
230507-rfqmwseh64
-
MD5
4b8fee87adfffb9ca8948b72f42b7b0d
-
SHA1
a120d0ba1e4ed45665a7bff6b89c57fa4fc4fb1d
-
SHA256
1b19d19057572d7b5a8f93c2aab42ee97fad4a2fac315d7f1a29d4f6bcc64abc
-
SHA512
2f5ac1c6c84f8de21335583c65792c76b750ee8b9105a27b7fb6b362c12a408a73c98ae5ec412f31911e29b5491b70544bfeced31016df24ce4be7bdeb51a509
-
SSDEEP
12288:NMr1y90VmDo1FJJyCWkcPv4qszyy6ruavemcE:gyto1FJRWkyv42rjemP
Static task
static1
Behavioral task
behavioral1
Sample
1b19d19057572d7b5a8f93c2aab42ee97fad4a2fac315d7f1a29d4f6bcc64abc.exe
Resource
win10v2004-20230220-en
Malware Config
Extracted
redline
domor
217.196.96.101:4132
-
auth_value
39471bda00546bb0435bc7adfd6881dc
Targets
-
-
Target
1b19d19057572d7b5a8f93c2aab42ee97fad4a2fac315d7f1a29d4f6bcc64abc
-
Size
480KB
-
MD5
4b8fee87adfffb9ca8948b72f42b7b0d
-
SHA1
a120d0ba1e4ed45665a7bff6b89c57fa4fc4fb1d
-
SHA256
1b19d19057572d7b5a8f93c2aab42ee97fad4a2fac315d7f1a29d4f6bcc64abc
-
SHA512
2f5ac1c6c84f8de21335583c65792c76b750ee8b9105a27b7fb6b362c12a408a73c98ae5ec412f31911e29b5491b70544bfeced31016df24ce4be7bdeb51a509
-
SSDEEP
12288:NMr1y90VmDo1FJJyCWkcPv4qszyy6ruavemcE:gyto1FJRWkyv42rjemP
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-