Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
96e30f1abebf7baa9149dbd8fd6d34bf50aeeb9491f62a3323e0d4f61c18bd1f
-
Size
704KB
-
Sample
230827-emxzbsfc77
-
MD5
eaf0721831fd28d2c4d12ea509eb9ae2
-
SHA1
453a482b7e2d0c182634a2b5591dacdbcc8e8aa1
-
SHA256
96e30f1abebf7baa9149dbd8fd6d34bf50aeeb9491f62a3323e0d4f61c18bd1f
-
SHA512
217424fcdd089186f4176fadfbb651121eba3d6e8ce48479851ef07a7c196ab2d680a5afa8636f547a6e2d1afe5573eca88f1d69f42ef278ad327c0725d0b5e9
-
SSDEEP
12288:dMrZy900kiIuKJszAeCse0RcP7ZuCUgDQm/3y+1hARkw0EIaWXXnDhCDLNl:4ylTeLeCV0R67ZuCfLV20EIRX1Q
Static task
static1
Behavioral task
behavioral1
Sample
96e30f1abebf7baa9149dbd8fd6d34bf50aeeb9491f62a3323e0d4f61c18bd1f.exe
Resource
win10v2004-20230703-en
Malware Config
Extracted
amadey
3.87
77.91.68.18/nice/index.php
Extracted
redline
nrava
77.91.124.82:19071
-
auth_value
43fe50e9ee6afb85588e03ac9676e2f7
Targets
-
-
Target
96e30f1abebf7baa9149dbd8fd6d34bf50aeeb9491f62a3323e0d4f61c18bd1f
-
Size
704KB
-
MD5
eaf0721831fd28d2c4d12ea509eb9ae2
-
SHA1
453a482b7e2d0c182634a2b5591dacdbcc8e8aa1
-
SHA256
96e30f1abebf7baa9149dbd8fd6d34bf50aeeb9491f62a3323e0d4f61c18bd1f
-
SHA512
217424fcdd089186f4176fadfbb651121eba3d6e8ce48479851ef07a7c196ab2d680a5afa8636f547a6e2d1afe5573eca88f1d69f42ef278ad327c0725d0b5e9
-
SSDEEP
12288:dMrZy900kiIuKJszAeCse0RcP7ZuCUgDQm/3y+1hARkw0EIaWXXnDhCDLNl:4ylTeLeCV0R67ZuCfLV20EIRX1Q
-
Detects Healer an antivirus disabler dropper
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1