Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
afa9f415da8f539df9516efc25ab2659.exe
-
Size
815KB
-
Sample
230702-gsljlabh6y
-
MD5
afa9f415da8f539df9516efc25ab2659
-
SHA1
ce56d87d47ddbdc1795fa83ac943807bbe610ea6
-
SHA256
8af5beb8e8f2e565f5cc9abf908bfb6758d8c74ed797cc0ac724076660cbe4cb
-
SHA512
98ce5d6d88c42b98f9b3bd3f7ac4942ed979097541d55e71eb61090caaf33a4044e8d233e5776fae53feb93ea71234174d78ec1be060dc1df1a9dd79280f5c92
-
SSDEEP
12288:PszCGcQ2PBsO4K2krms5zM/ihaGUiRwS8H9fWlAzjSGihr9t8MvBHsc699jZxpx:EzCGQr4K2YwMaGNesySGuKM5McyF
Static task
static1
Behavioral task
behavioral1
Sample
afa9f415da8f539df9516efc25ab2659.exe
Resource
win7-20230621-en
Behavioral task
behavioral2
Sample
afa9f415da8f539df9516efc25ab2659.exe
Resource
win10v2004-20230621-en
Malware Config
Extracted
redline
narko
83.97.73.134:19071
-
auth_value
a9d8c6db81c7e486f5832bc2ee48cb84
Extracted
smokeloader
2022
http://77.91.68.29/fks/
Extracted
amadey
3.84
77.91.68.63/doma/net/index.php
Extracted
redline
bruno
83.97.73.134:19071
-
auth_value
b23e240c277e85ce9d49d6165c0a2b48
Targets
-
-
Target
afa9f415da8f539df9516efc25ab2659.exe
-
Size
815KB
-
MD5
afa9f415da8f539df9516efc25ab2659
-
SHA1
ce56d87d47ddbdc1795fa83ac943807bbe610ea6
-
SHA256
8af5beb8e8f2e565f5cc9abf908bfb6758d8c74ed797cc0ac724076660cbe4cb
-
SHA512
98ce5d6d88c42b98f9b3bd3f7ac4942ed979097541d55e71eb61090caaf33a4044e8d233e5776fae53feb93ea71234174d78ec1be060dc1df1a9dd79280f5c92
-
SSDEEP
12288:PszCGcQ2PBsO4K2krms5zM/ihaGUiRwS8H9fWlAzjSGihr9t8MvBHsc699jZxpx:EzCGQr4K2YwMaGNesySGuKM5McyF
-
Detects Healer an antivirus disabler dropper
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Downloads MZ/PE file
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory
-