Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
312fb271db5b9ac082ad3705d4c33d6c37141aeb24f277743212193137531787
-
Size
479KB
-
Sample
230510-khv7tsfa65
-
MD5
f4b837d1e99b0d1c2472e260ebb82c3a
-
SHA1
e29b983e1d429d69851efb852a4405b63a4470b5
-
SHA256
312fb271db5b9ac082ad3705d4c33d6c37141aeb24f277743212193137531787
-
SHA512
0c57f63d4b0d2bfd802b1a8acc669d96c7e9d627d3284855d5350eff566e2ff3c60a86637f60de6531df1172ebce5d26d039534d67666e140c6a778ecf02f0b6
-
SSDEEP
12288:8Mrfy909zkk0aLkHgpEDNLlc6nLaPsmCpr:7y266igCphFaELd
Static task
static1
Behavioral task
behavioral1
Sample
312fb271db5b9ac082ad3705d4c33d6c37141aeb24f277743212193137531787.exe
Resource
win10v2004-20230221-en
Malware Config
Extracted
redline
divan
217.196.96.102:4132
-
auth_value
b414986bebd7f5a3ec9aee0341b8e769
Targets
-
-
Target
312fb271db5b9ac082ad3705d4c33d6c37141aeb24f277743212193137531787
-
Size
479KB
-
MD5
f4b837d1e99b0d1c2472e260ebb82c3a
-
SHA1
e29b983e1d429d69851efb852a4405b63a4470b5
-
SHA256
312fb271db5b9ac082ad3705d4c33d6c37141aeb24f277743212193137531787
-
SHA512
0c57f63d4b0d2bfd802b1a8acc669d96c7e9d627d3284855d5350eff566e2ff3c60a86637f60de6531df1172ebce5d26d039534d67666e140c6a778ecf02f0b6
-
SSDEEP
12288:8Mrfy909zkk0aLkHgpEDNLlc6nLaPsmCpr:7y266igCphFaELd
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-