Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
4dd035e705434364c9ba08e5d003dca57d2cd7d45ac01d859dd6313493262599
-
Size
390KB
-
Sample
230718-2f6zzsec74
-
MD5
4a1f2fdbd7fb0aef5bcac8845b620894
-
SHA1
3551c38d872553143988f35715a6433a64c119d6
-
SHA256
4dd035e705434364c9ba08e5d003dca57d2cd7d45ac01d859dd6313493262599
-
SHA512
5db23f27eef538249cd0235064297a9153a608f62168d8faa43bf6ad5ce862171119f1dc92aad1cc67b9ef29effc299633559fc3ba733751f46497f1a8b05356
-
SSDEEP
6144:K6y+bnr+yp0yN90QECULxD5nYDQ1uKl9xdBdvKx45bqgbqBIrQ+3uTSqh:SMray90EQrYE1pbxdTKK5kSQ+eTSqh
Static task
static1
Behavioral task
behavioral1
Sample
4dd035e705434364c9ba08e5d003dca57d2cd7d45ac01d859dd6313493262599.exe
Resource
win10v2004-20230703-en
Malware Config
Extracted
amadey
3.85
77.91.68.3/home/love/index.php
Extracted
redline
roma
77.91.68.56:19071
-
auth_value
f099c2cf92834dbc554a94e1456cf576
Targets
-
-
Target
4dd035e705434364c9ba08e5d003dca57d2cd7d45ac01d859dd6313493262599
-
Size
390KB
-
MD5
4a1f2fdbd7fb0aef5bcac8845b620894
-
SHA1
3551c38d872553143988f35715a6433a64c119d6
-
SHA256
4dd035e705434364c9ba08e5d003dca57d2cd7d45ac01d859dd6313493262599
-
SHA512
5db23f27eef538249cd0235064297a9153a608f62168d8faa43bf6ad5ce862171119f1dc92aad1cc67b9ef29effc299633559fc3ba733751f46497f1a8b05356
-
SSDEEP
6144:K6y+bnr+yp0yN90QECULxD5nYDQ1uKl9xdBdvKx45bqgbqBIrQ+3uTSqh:SMray90EQrYE1pbxdTKK5kSQ+eTSqh
-
Detects Healer an antivirus disabler dropper
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-