Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
0ef6ee1747c249350eabdae6baff60cfe5227e1437a8e3bcbe197b4e6a002792
-
Size
577KB
-
Sample
230615-3bce9abg47
-
MD5
6776d282c04c1e1bcba629feb7ff7f8a
-
SHA1
942028864930c5cae202b73745bf9eff1ef483c1
-
SHA256
0ef6ee1747c249350eabdae6baff60cfe5227e1437a8e3bcbe197b4e6a002792
-
SHA512
642238fbcde0ef9f7aa610028b384b25f15c0bc5e2c30669279e9811df8c82a1c8a4455b7593e868da06015479d14ee0cfb4ca28dd8f67231688c73c8e02b076
-
SSDEEP
12288:KMr2y90AlnI1EfjjGeKYsa5kK+zG3+a7gr5V6FmDYF8DLvlIkE4lMxW7+:4ydnI1Ef3GXwCV851PFRkZlTy
Static task
static1
Malware Config
Extracted
redline
dana
83.97.73.130:19061
-
auth_value
da2d1691db653e49676d799e1eae2673
Extracted
amadey
3.84
77.91.68.63/doma/net/index.php
Extracted
redline
joker
83.97.73.130:19061
-
auth_value
a98d303cc28bb3b32a23c59214ae3bc0
Targets
-
-
Target
0ef6ee1747c249350eabdae6baff60cfe5227e1437a8e3bcbe197b4e6a002792
-
Size
577KB
-
MD5
6776d282c04c1e1bcba629feb7ff7f8a
-
SHA1
942028864930c5cae202b73745bf9eff1ef483c1
-
SHA256
0ef6ee1747c249350eabdae6baff60cfe5227e1437a8e3bcbe197b4e6a002792
-
SHA512
642238fbcde0ef9f7aa610028b384b25f15c0bc5e2c30669279e9811df8c82a1c8a4455b7593e868da06015479d14ee0cfb4ca28dd8f67231688c73c8e02b076
-
SSDEEP
12288:KMr2y90AlnI1EfjjGeKYsa5kK+zG3+a7gr5V6FmDYF8DLvlIkE4lMxW7+:4ydnI1Ef3GXwCV851PFRkZlTy
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-