Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
401843b736202f24efce50245a8ef503d67c561a857a31adfe825cc005c8de51
-
Size
805KB
-
Sample
230528-rg23bafg2t
-
MD5
f15f8447083e29f68427f68fbabb40ab
-
SHA1
5623cb5c8d3ca279eb9891f589c23068208d70b9
-
SHA256
401843b736202f24efce50245a8ef503d67c561a857a31adfe825cc005c8de51
-
SHA512
1406ff4ce8a3151c4fc6f5787dcec3afa2d8d0cc93d6d56e8c2dbc86fc6793718fb0450e7b00e637fdf8c6f7fce459c195ec1d6216c27c19d79014680f218003
-
SSDEEP
24576:gyjIcI9W7kpIMYQ+kj/kSwmsdrZ9XxJl2MpWIUhMHK:nj3H4jsSwmsPBxJSI
Static task
static1
Behavioral task
behavioral1
Sample
401843b736202f24efce50245a8ef503d67c561a857a31adfe825cc005c8de51.exe
Resource
win10v2004-20230220-en
Malware Config
Extracted
redline
diza
83.97.73.127:19045
-
auth_value
0d09b419c8bc967f91c68be4a17e92ee
Extracted
redline
metro
83.97.73.127:19045
-
auth_value
f7fd4aa816bdbaad933b45b51d9b6b1a
Targets
-
-
Target
401843b736202f24efce50245a8ef503d67c561a857a31adfe825cc005c8de51
-
Size
805KB
-
MD5
f15f8447083e29f68427f68fbabb40ab
-
SHA1
5623cb5c8d3ca279eb9891f589c23068208d70b9
-
SHA256
401843b736202f24efce50245a8ef503d67c561a857a31adfe825cc005c8de51
-
SHA512
1406ff4ce8a3151c4fc6f5787dcec3afa2d8d0cc93d6d56e8c2dbc86fc6793718fb0450e7b00e637fdf8c6f7fce459c195ec1d6216c27c19d79014680f218003
-
SSDEEP
24576:gyjIcI9W7kpIMYQ+kj/kSwmsdrZ9XxJl2MpWIUhMHK:nj3H4jsSwmsPBxJSI
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Downloads MZ/PE file
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext
-