Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
32e77d9d54a04a0d8407f8c9d1e943a89b832385b26026277def87bdbeaaf902
-
Size
1.0MB
-
Sample
230518-q35jwsae9x
-
MD5
9f7dd99e8ed6912b977552560a89e4de
-
SHA1
ec6df909f819089867bd374c4ab5f8a5e7955ea6
-
SHA256
32e77d9d54a04a0d8407f8c9d1e943a89b832385b26026277def87bdbeaaf902
-
SHA512
efd3b1e59cf3d4c831363d32a85ac0e87259cc8ab06c1f35e45155d985b82e1e87c67f7334a7b330081c0cf7aec48546803175c74fb31bd82bcfceb8d07f45c2
-
SSDEEP
24576:syx+KqRKh9aAb84iBMP4t+S+zjyXKIM+wNcszT2U1p:bxlq8bb840Mgt+S+zjyXDM+Hs1
Static task
static1
Behavioral task
behavioral1
Sample
32e77d9d54a04a0d8407f8c9d1e943a89b832385b26026277def87bdbeaaf902.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
32e77d9d54a04a0d8407f8c9d1e943a89b832385b26026277def87bdbeaaf902.exe
Resource
win10v2004-20230220-en
Malware Config
Extracted
redline
dream
77.91.68.253:4138
-
auth_value
7b4f26a4ca794e30cee1032d5cb62f5c
Targets
-
-
Target
32e77d9d54a04a0d8407f8c9d1e943a89b832385b26026277def87bdbeaaf902
-
Size
1.0MB
-
MD5
9f7dd99e8ed6912b977552560a89e4de
-
SHA1
ec6df909f819089867bd374c4ab5f8a5e7955ea6
-
SHA256
32e77d9d54a04a0d8407f8c9d1e943a89b832385b26026277def87bdbeaaf902
-
SHA512
efd3b1e59cf3d4c831363d32a85ac0e87259cc8ab06c1f35e45155d985b82e1e87c67f7334a7b330081c0cf7aec48546803175c74fb31bd82bcfceb8d07f45c2
-
SSDEEP
24576:syx+KqRKh9aAb84iBMP4t+S+zjyXKIM+wNcszT2U1p:bxlq8bb840Mgt+S+zjyXDM+Hs1
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext
-