Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
805229f0732a7f64e5a611c73b3152dd30539769a3cd97bea9d268e9a43b930d
-
Size
479KB
-
Sample
230509-m3xmhafd96
-
MD5
b80467bbf454b6015f056fc29eb8f237
-
SHA1
64ef8cb097a5ba449ffbc0a9c4a9a555e5e4523e
-
SHA256
805229f0732a7f64e5a611c73b3152dd30539769a3cd97bea9d268e9a43b930d
-
SHA512
c71967e6b58394b6b3186cdc9a5b9687f2ab0c85b5d771a6a1e3b5d48eaf8f6d1327e11879b1540f0a0fc7da4d821ab4538a5bbdb032315d84511e8872b84cd7
-
SSDEEP
12288:3Mrxy90pEGKRcjohanbAwWHxncTZTmtQiwFMY:CyfBKfixnuEm
Static task
static1
Behavioral task
behavioral1
Sample
805229f0732a7f64e5a611c73b3152dd30539769a3cd97bea9d268e9a43b930d.exe
Resource
win10v2004-20230220-en
Malware Config
Extracted
redline
douma
217.196.96.101:4132
-
auth_value
e7c0659b5f9d26f2f97df8d25fefbb44
Targets
-
-
Target
805229f0732a7f64e5a611c73b3152dd30539769a3cd97bea9d268e9a43b930d
-
Size
479KB
-
MD5
b80467bbf454b6015f056fc29eb8f237
-
SHA1
64ef8cb097a5ba449ffbc0a9c4a9a555e5e4523e
-
SHA256
805229f0732a7f64e5a611c73b3152dd30539769a3cd97bea9d268e9a43b930d
-
SHA512
c71967e6b58394b6b3186cdc9a5b9687f2ab0c85b5d771a6a1e3b5d48eaf8f6d1327e11879b1540f0a0fc7da4d821ab4538a5bbdb032315d84511e8872b84cd7
-
SSDEEP
12288:3Mrxy90pEGKRcjohanbAwWHxncTZTmtQiwFMY:CyfBKfixnuEm
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-