Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
c83e07553e4b318ca5c2f1186f4dd112bae4a63b0b4e93e2bce1422aba86dcac
-
Size
884KB
-
Sample
230511-rnn42adf69
-
MD5
8bcb0d914b9ddb9e5eceaf01d7b0b45e
-
SHA1
99e8e9ab07f662d184130f48fa17fbb50b160e06
-
SHA256
c83e07553e4b318ca5c2f1186f4dd112bae4a63b0b4e93e2bce1422aba86dcac
-
SHA512
cd792d52f18555f01da5e916a79aac0ae323966b5ac510c569207baac73a051b4932494848db897bb4a06316f475b85ffbc5fd9ccaa300ce193c82da882c7c15
-
SSDEEP
24576:AyzI259J6U++WwaavxQXNI2tJ7HUTK4V:HZnJ6U++HfOntJw+4
Static task
static1
Behavioral task
behavioral1
Sample
c83e07553e4b318ca5c2f1186f4dd112bae4a63b0b4e93e2bce1422aba86dcac.exe
Resource
win10v2004-20230220-en
Malware Config
Extracted
redline
debro
185.161.248.75:4132
-
auth_value
18c2c191aebfde5d1787ec8d805a01a8
Extracted
redline
gogen
185.161.248.75:4132
-
auth_value
dfb27ce11afd52277523c8e405853d53
Targets
-
-
Target
c83e07553e4b318ca5c2f1186f4dd112bae4a63b0b4e93e2bce1422aba86dcac
-
Size
884KB
-
MD5
8bcb0d914b9ddb9e5eceaf01d7b0b45e
-
SHA1
99e8e9ab07f662d184130f48fa17fbb50b160e06
-
SHA256
c83e07553e4b318ca5c2f1186f4dd112bae4a63b0b4e93e2bce1422aba86dcac
-
SHA512
cd792d52f18555f01da5e916a79aac0ae323966b5ac510c569207baac73a051b4932494848db897bb4a06316f475b85ffbc5fd9ccaa300ce193c82da882c7c15
-
SSDEEP
24576:AyzI259J6U++WwaavxQXNI2tJ7HUTK4V:HZnJ6U++HfOntJw+4
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext
-