Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
36b760d136b3e37c13e4803e9a3899478c9a1b05fca123e18b3b2e645eaf7149
-
Size
761KB
-
Sample
230527-vljnbace38
-
MD5
fd20b7cc0471907d366c167fa15aa065
-
SHA1
11dc5f0651983cc9efb4c342719f3975a67a54dc
-
SHA256
36b760d136b3e37c13e4803e9a3899478c9a1b05fca123e18b3b2e645eaf7149
-
SHA512
158dada4fd15bb06b068bceae7f50c7bedb9acec8917573ff666af55b5772a69cea9fcce01703c5c4d9e127e058ef4085d7019794c833209ce7fd7c3d271761c
-
SSDEEP
12288:kMrJy90Ud0zDRXHKWFLJMjpGq0qbipeHKaTxDB7q3b1Qm1+BvuiHVbeaLO8DCGoN:FyP0FLJMFGq0OipeHKQxl7qm4uPxDW
Static task
static1
Behavioral task
behavioral1
Sample
36b760d136b3e37c13e4803e9a3899478c9a1b05fca123e18b3b2e645eaf7149.exe
Resource
win10v2004-20230220-en
Malware Config
Extracted
redline
mura
83.97.73.127:19062
-
auth_value
b2ee4a66a20fb9e998d6a68277565331
Extracted
redline
heroy
83.97.73.127:19062
-
auth_value
b2879468e50d2d36e66f1a067d4a8bb3
Targets
-
-
Target
36b760d136b3e37c13e4803e9a3899478c9a1b05fca123e18b3b2e645eaf7149
-
Size
761KB
-
MD5
fd20b7cc0471907d366c167fa15aa065
-
SHA1
11dc5f0651983cc9efb4c342719f3975a67a54dc
-
SHA256
36b760d136b3e37c13e4803e9a3899478c9a1b05fca123e18b3b2e645eaf7149
-
SHA512
158dada4fd15bb06b068bceae7f50c7bedb9acec8917573ff666af55b5772a69cea9fcce01703c5c4d9e127e058ef4085d7019794c833209ce7fd7c3d271761c
-
SSDEEP
12288:kMrJy90Ud0zDRXHKWFLJMjpGq0qbipeHKaTxDB7q3b1Qm1+BvuiHVbeaLO8DCGoN:FyP0FLJMFGq0OipeHKQxl7qm4uPxDW
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext
-