Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
a5d2a7d53aeeac4f0812340e159d8c66.exe
-
Size
755KB
-
Sample
230903-dhlvtsgb4w
-
MD5
a5d2a7d53aeeac4f0812340e159d8c66
-
SHA1
5f1f46a6a557656ca04f562c07f2cb7084c6b094
-
SHA256
e481b0400f271dce93ba7691e428c233f4f5e5744c7b276675fde5aee14e75c9
-
SHA512
0a6df7c1dc7b68574249b1c878c0be8ebe2ee3cd9161dff385139f33ec1ba54f07b0af3a6f426040926771060c5393aec177ad247ba5d46401a549fc9c8423f4
-
SSDEEP
12288:U9UPHFtND4ZIrsHWihcF4JJTnJQZgplDliDDmNGkMAJIJ6zcRSdiuVHJ/R/++Bm0:U9qFtp6xWFkJ2ZSDYDc9MAJdPV7+ymFm
Static task
static1
Behavioral task
behavioral1
Sample
a5d2a7d53aeeac4f0812340e159d8c66.exe
Resource
win7-20230831-en
Malware Config
Extracted
redline
cheat
45.137.22.116:55615
Targets
-
-
Target
a5d2a7d53aeeac4f0812340e159d8c66.exe
-
Size
755KB
-
MD5
a5d2a7d53aeeac4f0812340e159d8c66
-
SHA1
5f1f46a6a557656ca04f562c07f2cb7084c6b094
-
SHA256
e481b0400f271dce93ba7691e428c233f4f5e5744c7b276675fde5aee14e75c9
-
SHA512
0a6df7c1dc7b68574249b1c878c0be8ebe2ee3cd9161dff385139f33ec1ba54f07b0af3a6f426040926771060c5393aec177ad247ba5d46401a549fc9c8423f4
-
SSDEEP
12288:U9UPHFtND4ZIrsHWihcF4JJTnJQZgplDliDDmNGkMAJIJ6zcRSdiuVHJ/R/++Bm0:U9qFtp6xWFkJ2ZSDYDc9MAJdPV7+ymFm
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
SectopRAT payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext
-