Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
0ab8a7598b28e57dbab82e790a716c192e9e8e19b8153e782b98ed951e977968
-
Size
1.1MB
-
Sample
230515-g36yaahd6s
-
MD5
42f48c46879de1ca4a2fda7825e1d2c0
-
SHA1
ca75d7e3c4a05c80126c83e243c488a3858fcea5
-
SHA256
0ab8a7598b28e57dbab82e790a716c192e9e8e19b8153e782b98ed951e977968
-
SHA512
1b74d836360f2550d759ac374a62ebd595312a0eda8f8adab7562a9e5b36459081d5fc6599baf418db2be32f28789e5d4e5c9f3bf5ad6cc29ef3a528813b3ad0
-
SSDEEP
24576:pyvOMfj/ksSZbpGQq8usT/QqUH0OA+v6FZiwHvw/UfDUdWz1:cvOML/iZAQpuDz0FZBHvTgde
Static task
static1
Behavioral task
behavioral1
Sample
0ab8a7598b28e57dbab82e790a716c192e9e8e19b8153e782b98ed951e977968.exe
Resource
win10-20230220-en
Malware Config
Extracted
redline
difoz
185.161.248.75:4132
-
auth_value
ee98afda432cdf29ea1dd0464fdc94e6
Extracted
redline
horor
185.161.248.75:4132
-
auth_value
b8d506fe48db15c38fb031d07f42d529
Targets
-
-
Target
0ab8a7598b28e57dbab82e790a716c192e9e8e19b8153e782b98ed951e977968
-
Size
1.1MB
-
MD5
42f48c46879de1ca4a2fda7825e1d2c0
-
SHA1
ca75d7e3c4a05c80126c83e243c488a3858fcea5
-
SHA256
0ab8a7598b28e57dbab82e790a716c192e9e8e19b8153e782b98ed951e977968
-
SHA512
1b74d836360f2550d759ac374a62ebd595312a0eda8f8adab7562a9e5b36459081d5fc6599baf418db2be32f28789e5d4e5c9f3bf5ad6cc29ef3a528813b3ad0
-
SSDEEP
24576:pyvOMfj/ksSZbpGQq8usT/QqUH0OA+v6FZiwHvw/UfDUdWz1:cvOML/iZAQpuDz0FZBHvTgde
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext
-