Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
b3e5f3cd6a54e351fcbd024e4d2213a5ac27547305493dc2f53739130d7a2c85
-
Size
527KB
-
Sample
230701-3pkc1saa29
-
MD5
fb24ba34b54f86fddd5bdc16bd1b931a
-
SHA1
c45a8905c0cdcdd3f8f388e01194e8b23c0fd8c1
-
SHA256
b3e5f3cd6a54e351fcbd024e4d2213a5ac27547305493dc2f53739130d7a2c85
-
SHA512
dce10740383cc15689ebf9abd1f789c3740f02b341a1f5c208a96ec13ff54d22c9653b23838b790d674c425ef00e7b3fbb327ae022dec3ea227b594782e8ce38
-
SSDEEP
12288:pG3LEx7Q2PBsM6YXCkr65LXz4QIGDtQdQZ:pG3LExNwJkr6RsQIGj
Static task
static1
Behavioral task
behavioral1
Sample
b3e5f3cd6a54e351fcbd024e4d2213a5ac27547305493dc2f53739130d7a2c85.exe
Resource
win7-20230621-en
Behavioral task
behavioral2
Sample
b3e5f3cd6a54e351fcbd024e4d2213a5ac27547305493dc2f53739130d7a2c85.exe
Resource
win10-20230621-en
Malware Config
Extracted
redline
smoke
83.97.73.131:19071
-
auth_value
aaa47198b84c95fcce9397339e8af9d4
Extracted
amadey
3.84
77.91.68.63/doma/net/index.php
Extracted
redline
bruno
83.97.73.134:19071
-
auth_value
b23e240c277e85ce9d49d6165c0a2b48
Extracted
smokeloader
2022
http://77.91.68.29/fks/
Targets
-
-
Target
b3e5f3cd6a54e351fcbd024e4d2213a5ac27547305493dc2f53739130d7a2c85
-
Size
527KB
-
MD5
fb24ba34b54f86fddd5bdc16bd1b931a
-
SHA1
c45a8905c0cdcdd3f8f388e01194e8b23c0fd8c1
-
SHA256
b3e5f3cd6a54e351fcbd024e4d2213a5ac27547305493dc2f53739130d7a2c85
-
SHA512
dce10740383cc15689ebf9abd1f789c3740f02b341a1f5c208a96ec13ff54d22c9653b23838b790d674c425ef00e7b3fbb327ae022dec3ea227b594782e8ce38
-
SSDEEP
12288:pG3LEx7Q2PBsM6YXCkr65LXz4QIGDtQdQZ:pG3LExNwJkr6RsQIGj
-
Detects Healer an antivirus disabler dropper
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-