Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
2b679c73c1c34a4f212161cce6a191a1aaaef7f06a5a1d0c4231edf567a1a038
-
Size
389KB
-
Sample
230721-fm483scf9t
-
MD5
b24a041c6ad5792b803f486f55811c3c
-
SHA1
1f51afef9c3b974f1f2c3cb999b02ccbe4b00632
-
SHA256
2b679c73c1c34a4f212161cce6a191a1aaaef7f06a5a1d0c4231edf567a1a038
-
SHA512
4f858c94f89caaca045a0e519b561852de9bc367ec92f5092655c472e0b509c9041b63a681d5b38e44bc6cfb32ecff2704c1fff3defa3d260ed6a6ad93a7ef52
-
SSDEEP
6144:KSy+bnr+Jp0yN90QElbkhwBmVlYAtXAt3onsXSjPRmPOe6Xsc0LKiOMpjvFNK:SMr5y90nOwBmLYAtwswPOe6W+z8je
Static task
static1
Behavioral task
behavioral1
Sample
2b679c73c1c34a4f212161cce6a191a1aaaef7f06a5a1d0c4231edf567a1a038.exe
Resource
win10v2004-20230703-en
Malware Config
Extracted
redline
nasa
77.91.68.68:19071
-
auth_value
6da71218d8a9738ea3a9a78b5677589b
Targets
-
-
Target
2b679c73c1c34a4f212161cce6a191a1aaaef7f06a5a1d0c4231edf567a1a038
-
Size
389KB
-
MD5
b24a041c6ad5792b803f486f55811c3c
-
SHA1
1f51afef9c3b974f1f2c3cb999b02ccbe4b00632
-
SHA256
2b679c73c1c34a4f212161cce6a191a1aaaef7f06a5a1d0c4231edf567a1a038
-
SHA512
4f858c94f89caaca045a0e519b561852de9bc367ec92f5092655c472e0b509c9041b63a681d5b38e44bc6cfb32ecff2704c1fff3defa3d260ed6a6ad93a7ef52
-
SSDEEP
6144:KSy+bnr+Jp0yN90QElbkhwBmVlYAtXAt3onsXSjPRmPOe6Xsc0LKiOMpjvFNK:SMr5y90nOwBmLYAtwswPOe6W+z8je
-
Detects Healer an antivirus disabler dropper
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Executes dropped EXE
-
Adds Run key to start application
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1