Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
86809f07e6dfb4a94ea7bc501631c15c4a24406f1fe60b0eb82d8352551abcc2
-
Size
770KB
-
Sample
230527-y1ppnade3v
-
MD5
813fd5e236a75c8788e2f7302d8d2436
-
SHA1
35da5f7f25eed608eb20037bb38c6a326c7e7b3b
-
SHA256
86809f07e6dfb4a94ea7bc501631c15c4a24406f1fe60b0eb82d8352551abcc2
-
SHA512
4e32fc91699bd40489b9a4c017145077369439bfd3b4b6be14381b15e138e13edca307845cb13a0a49e764e6e4b34afcd61788a995562040d6cf08d6e65d95de
-
SSDEEP
12288:AMroy90TqDD3xhSOSn0/htcES/t17gOJsoP3iqksTIZOJ4WuKr9c1YE3Lb:Yyky3jSb0ZtDSl17goZlIZzOtE7b
Static task
static1
Behavioral task
behavioral1
Sample
86809f07e6dfb4a94ea7bc501631c15c4a24406f1fe60b0eb82d8352551abcc2.exe
Resource
win10v2004-20230220-en
Malware Config
Extracted
redline
mura
83.97.73.127:19062
-
auth_value
b2ee4a66a20fb9e998d6a68277565331
Extracted
redline
heroy
83.97.73.127:19062
-
auth_value
b2879468e50d2d36e66f1a067d4a8bb3
Targets
-
-
Target
86809f07e6dfb4a94ea7bc501631c15c4a24406f1fe60b0eb82d8352551abcc2
-
Size
770KB
-
MD5
813fd5e236a75c8788e2f7302d8d2436
-
SHA1
35da5f7f25eed608eb20037bb38c6a326c7e7b3b
-
SHA256
86809f07e6dfb4a94ea7bc501631c15c4a24406f1fe60b0eb82d8352551abcc2
-
SHA512
4e32fc91699bd40489b9a4c017145077369439bfd3b4b6be14381b15e138e13edca307845cb13a0a49e764e6e4b34afcd61788a995562040d6cf08d6e65d95de
-
SSDEEP
12288:AMroy90TqDD3xhSOSn0/htcES/t17gOJsoP3iqksTIZOJ4WuKr9c1YE3Lb:Yyky3jSb0ZtDSl17goZlIZzOtE7b
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext
-