Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
d4bdcccfd716d226f5161320cf4168b6c077e51d788d410654678cbd2e00ff63
-
Size
389KB
-
Sample
230719-mr3dlsdc8w
-
MD5
e84b338ca711b0ebb9b61944a0ef98ff
-
SHA1
b797fc849a85fcbd8521af4d672fa63397504f8d
-
SHA256
d4bdcccfd716d226f5161320cf4168b6c077e51d788d410654678cbd2e00ff63
-
SHA512
c62fec5abf62ca946f79654f08edb32b86831c978b9ebcc9cbad60fc976d8714b84ac61fd82143cf53c26f540c55f002a46d5e1ac38b829e4385a0ff6b89b929
-
SSDEEP
6144:K6y+bnr+Ep0yN90QEqF3vKYfnkn+cfA6MBv5yvGf+K21PJzBlxdzus+rqmTf:aMrMy90QFfzfhzBhyh9PJVdzus+rb
Static task
static1
Behavioral task
behavioral1
Sample
d4bdcccfd716d226f5161320cf4168b6c077e51d788d410654678cbd2e00ff63.exe
Resource
win10v2004-20230703-en
Malware Config
Extracted
amadey
3.85
77.91.68.3/home/love/index.php
Extracted
redline
nasa
77.91.68.68:19071
-
auth_value
6da71218d8a9738ea3a9a78b5677589b
Targets
-
-
Target
d4bdcccfd716d226f5161320cf4168b6c077e51d788d410654678cbd2e00ff63
-
Size
389KB
-
MD5
e84b338ca711b0ebb9b61944a0ef98ff
-
SHA1
b797fc849a85fcbd8521af4d672fa63397504f8d
-
SHA256
d4bdcccfd716d226f5161320cf4168b6c077e51d788d410654678cbd2e00ff63
-
SHA512
c62fec5abf62ca946f79654f08edb32b86831c978b9ebcc9cbad60fc976d8714b84ac61fd82143cf53c26f540c55f002a46d5e1ac38b829e4385a0ff6b89b929
-
SSDEEP
6144:K6y+bnr+Ep0yN90QEqF3vKYfnkn+cfA6MBv5yvGf+K21PJzBlxdzus+rqmTf:aMrMy90QFfzfhzBhyh9PJVdzus+rb
-
Detects Healer an antivirus disabler dropper
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-