Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
2525bf6a5a20d190df47378cbb16b2763e03501887929ebb0363bda598685770
-
Size
1.1MB
-
Sample
230515-hnz2vsfb44
-
MD5
29fe8917f99919522bfe66e77747960e
-
SHA1
2a0e2c781262713dba7daa2a5789fa3b8ed994bd
-
SHA256
2525bf6a5a20d190df47378cbb16b2763e03501887929ebb0363bda598685770
-
SHA512
4b825ffa7fcdebe72718952041563e3a0bea959d42254919262c791e7b23f022981ee8f39b95c0cf1d295ad233be591bfb2dfd8ae941f5b1499f1e63f8d4c209
-
SSDEEP
24576:hydc6K3zPTP9rdGx41zYZFGl4Dg96tOv3SmmUY1POgRQRYDBWaw1wwtdGJH:UdcpDbDGgEDMYg96pL1FjtWgmdGJ
Static task
static1
Behavioral task
behavioral1
Sample
2525bf6a5a20d190df47378cbb16b2763e03501887929ebb0363bda598685770.exe
Resource
win10v2004-20230220-en
Malware Config
Extracted
redline
difoz
185.161.248.75:4132
-
auth_value
ee98afda432cdf29ea1dd0464fdc94e6
Extracted
redline
horor
185.161.248.75:4132
-
auth_value
b8d506fe48db15c38fb031d07f42d529
Targets
-
-
Target
2525bf6a5a20d190df47378cbb16b2763e03501887929ebb0363bda598685770
-
Size
1.1MB
-
MD5
29fe8917f99919522bfe66e77747960e
-
SHA1
2a0e2c781262713dba7daa2a5789fa3b8ed994bd
-
SHA256
2525bf6a5a20d190df47378cbb16b2763e03501887929ebb0363bda598685770
-
SHA512
4b825ffa7fcdebe72718952041563e3a0bea959d42254919262c791e7b23f022981ee8f39b95c0cf1d295ad233be591bfb2dfd8ae941f5b1499f1e63f8d4c209
-
SSDEEP
24576:hydc6K3zPTP9rdGx41zYZFGl4Dg96tOv3SmmUY1POgRQRYDBWaw1wwtdGJH:UdcpDbDGgEDMYg96pL1FjtWgmdGJ
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext
-