Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
4e3b7fed2764874449d8736a7c7b3ac00de041458ddc640ae2d0c3773f671144
-
Size
1.1MB
-
Sample
230514-x9bzgsdd44
-
MD5
ac3c86588a350ec5523ac2e43206515c
-
SHA1
5b4341cffa7c87e5e432d9e72918c3c8f4dba81b
-
SHA256
4e3b7fed2764874449d8736a7c7b3ac00de041458ddc640ae2d0c3773f671144
-
SHA512
5810b4f80dae733e478ea2bdcb4821f787443c03d97fc7c371e3131463ad67a8eb22b9ce913fe282a5245d7db9e60aa5fcb3bf6d8250c2e121e36c4e5aec7b27
-
SSDEEP
24576:hyFMpbysSu1RQ4qMBeByjgufvPJzF6jtj/RJUlpxK:UF4ys71RQhMIByHPpYj1RJMpx
Static task
static1
Behavioral task
behavioral1
Sample
4e3b7fed2764874449d8736a7c7b3ac00de041458ddc640ae2d0c3773f671144.exe
Resource
win10v2004-20230220-en
Malware Config
Extracted
redline
muza
185.161.248.75:4132
-
auth_value
99f39e1ac98e0c0a729ab27594e72bc3
Extracted
redline
horor
185.161.248.75:4132
-
auth_value
b8d506fe48db15c38fb031d07f42d529
Targets
-
-
Target
4e3b7fed2764874449d8736a7c7b3ac00de041458ddc640ae2d0c3773f671144
-
Size
1.1MB
-
MD5
ac3c86588a350ec5523ac2e43206515c
-
SHA1
5b4341cffa7c87e5e432d9e72918c3c8f4dba81b
-
SHA256
4e3b7fed2764874449d8736a7c7b3ac00de041458ddc640ae2d0c3773f671144
-
SHA512
5810b4f80dae733e478ea2bdcb4821f787443c03d97fc7c371e3131463ad67a8eb22b9ce913fe282a5245d7db9e60aa5fcb3bf6d8250c2e121e36c4e5aec7b27
-
SSDEEP
24576:hyFMpbysSu1RQ4qMBeByjgufvPJzF6jtj/RJUlpxK:UF4ys71RQhMIByHPpYj1RJMpx
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext
-