Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
05995899.exe
-
Size
752KB
-
Sample
230530-x6s4labg5v
-
MD5
8495e47b736b5c3e6f653fd1f219a83f
-
SHA1
a8b3da09fa073720bba1d5aeace51e7e5a9bab0c
-
SHA256
0ad069c48ef263e34aef3eb505fdb73f3100072a593d8234b3fbab7c798bd7ac
-
SHA512
96be287d06e68b09bfc0da210ac131ea72613f4eb3f80ef92bd4c2f0f9a0fbe4e64106f52bde6f039eeaeba2a21789a7e8fec892016aeb7de834fd5ec4e37f36
-
SSDEEP
12288:SMrSy90FHI7yEZHp/NrbRUO9L7GtCa/1n6QkKHyZ7D3miu/2arHj7XLtOd3U:UyuaPdhNXuMLafwKHyF3qBrD77tp
Static task
static1
Behavioral task
behavioral1
Sample
05995899.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
05995899.exe
Resource
win10v2004-20230221-en
Malware Config
Extracted
redline
dusa
83.97.73.127:19045
-
auth_value
ee896466545fedf9de5406175fb82de5
Extracted
redline
ronin
83.97.73.127:19045
-
auth_value
4cce855f5ba9b9b6e5b1400f102745de
Targets
-
-
Target
05995899.exe
-
Size
752KB
-
MD5
8495e47b736b5c3e6f653fd1f219a83f
-
SHA1
a8b3da09fa073720bba1d5aeace51e7e5a9bab0c
-
SHA256
0ad069c48ef263e34aef3eb505fdb73f3100072a593d8234b3fbab7c798bd7ac
-
SHA512
96be287d06e68b09bfc0da210ac131ea72613f4eb3f80ef92bd4c2f0f9a0fbe4e64106f52bde6f039eeaeba2a21789a7e8fec892016aeb7de834fd5ec4e37f36
-
SSDEEP
12288:SMrSy90FHI7yEZHp/NrbRUO9L7GtCa/1n6QkKHyZ7D3miu/2arHj7XLtOd3U:UyuaPdhNXuMLafwKHyF3qBrD77tp
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext
-