Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
331502b02a8391a32574f87801f740a2d3698f142a50a5d55e6acb1501c84452.exe
-
Size
1.0MB
-
Sample
230522-hrhlzsef68
-
MD5
3cd946c8eb39ba77d8a826d0ac7afcf5
-
SHA1
cd29e3ee7afb3e021c4d562991f9509afac3c2f7
-
SHA256
331502b02a8391a32574f87801f740a2d3698f142a50a5d55e6acb1501c84452
-
SHA512
d853f618e685657ec6a072e624e7d8e6f7dd70b60423368e4cf60c753edb05ef1763c1383c224974ee649ee71b29453d7849251efb39bf320f3669c3f014faf6
-
SSDEEP
24576:gy2qkWYphoKoKebzCk9+bfuKv/yy5Tkv6oAvpio1:nlkh2L+vvK0Tu6zZ
Static task
static1
Behavioral task
behavioral1
Sample
331502b02a8391a32574f87801f740a2d3698f142a50a5d55e6acb1501c84452.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
331502b02a8391a32574f87801f740a2d3698f142a50a5d55e6acb1501c84452.exe
Resource
win10v2004-20230220-en
Malware Config
Extracted
redline
diza
185.161.248.37:4138
-
auth_value
0d09b419c8bc967f91c68be4a17e92ee
Targets
-
-
Target
331502b02a8391a32574f87801f740a2d3698f142a50a5d55e6acb1501c84452.exe
-
Size
1.0MB
-
MD5
3cd946c8eb39ba77d8a826d0ac7afcf5
-
SHA1
cd29e3ee7afb3e021c4d562991f9509afac3c2f7
-
SHA256
331502b02a8391a32574f87801f740a2d3698f142a50a5d55e6acb1501c84452
-
SHA512
d853f618e685657ec6a072e624e7d8e6f7dd70b60423368e4cf60c753edb05ef1763c1383c224974ee649ee71b29453d7849251efb39bf320f3669c3f014faf6
-
SSDEEP
24576:gy2qkWYphoKoKebzCk9+bfuKv/yy5Tkv6oAvpio1:nlkh2L+vvK0Tu6zZ
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext
-