Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
0b504a6d45ee699811a5c972ad410412d8bb1ad649ae94eae0c0da25564a5426
-
Size
752KB
-
Sample
230601-fs14lsdb5x
-
MD5
283d8235bccd00ae43ac9d3e61d15f9b
-
SHA1
a9374dcc8c50def5e0aa04d7f86f290127bb681b
-
SHA256
0b504a6d45ee699811a5c972ad410412d8bb1ad649ae94eae0c0da25564a5426
-
SHA512
bfccc1872726e41fc17b6058abbba3afe66e5c34f711bf9e900c68741d22517071d688405a9e15753c5c5ae71d6da62c90bda4ffe13599e876f5aff9e9eebd54
-
SSDEEP
12288:pMrgy90da3h4BUZFjrB4ONkABvdbbl3Y1u89Kb9UJAVza2M:9yU0h4BUZZB4OGAHwpUxUJMzg
Static task
static1
Behavioral task
behavioral1
Sample
0b504a6d45ee699811a5c972ad410412d8bb1ad649ae94eae0c0da25564a5426.exe
Resource
win10v2004-20230221-en
Malware Config
Extracted
redline
maxi
83.97.73.127:19045
-
auth_value
6a3f22e5f4209b056a3fd330dc71956a
Extracted
redline
rocker
83.97.73.127:19045
-
auth_value
b4693c25843b5a1c7d63376e73e32dae
Targets
-
-
Target
0b504a6d45ee699811a5c972ad410412d8bb1ad649ae94eae0c0da25564a5426
-
Size
752KB
-
MD5
283d8235bccd00ae43ac9d3e61d15f9b
-
SHA1
a9374dcc8c50def5e0aa04d7f86f290127bb681b
-
SHA256
0b504a6d45ee699811a5c972ad410412d8bb1ad649ae94eae0c0da25564a5426
-
SHA512
bfccc1872726e41fc17b6058abbba3afe66e5c34f711bf9e900c68741d22517071d688405a9e15753c5c5ae71d6da62c90bda4ffe13599e876f5aff9e9eebd54
-
SSDEEP
12288:pMrgy90da3h4BUZFjrB4ONkABvdbbl3Y1u89Kb9UJAVza2M:9yU0h4BUZZB4OGAHwpUxUJMzg
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext
-