Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
x8617677.exe
-
Size
433KB
-
Sample
230904-bqq4eadc68
-
MD5
962e75dbc359c90f0bba2a023ddcd05b
-
SHA1
3998ab0085eba0f94ad2ce1e14c7f33b4b2a277f
-
SHA256
90aa8dd0fdcecd5f6823dfca45358d244df4e3174736f5d5f42d04d90acabcb3
-
SHA512
aa3a0dac5c461fea5a2704984fde4bc6d7ddf9c6ce9d20c7bed7ba11cf24e8313804b6d16ec0430365c4e25c0d616e5bd3eaec48464bc26cf3698205fbacb6d2
-
SSDEEP
6144:KQy+bnr+up0yN90QE8LVuuyjnVdtwXKFxouT9M7n2lzIsTsir/U8r60iJBZ:IMriy90eLVuuyzPtXgu5Gn26eMZ
Static task
static1
Behavioral task
behavioral1
Sample
x8617677.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
x8617677.exe
Resource
win10-20230831-en
Malware Config
Extracted
amadey
3.87
77.91.68.18/nice/index.php
-
install_dir
b40d11255d
-
install_file
saves.exe
-
strings_key
fa622dfc42544927a6471829ee1fa9fe
Extracted
redline
sruta
77.91.124.82:19071
-
auth_value
c556edcd49703319eca74247de20c236
Targets
-
-
Target
x8617677.exe
-
Size
433KB
-
MD5
962e75dbc359c90f0bba2a023ddcd05b
-
SHA1
3998ab0085eba0f94ad2ce1e14c7f33b4b2a277f
-
SHA256
90aa8dd0fdcecd5f6823dfca45358d244df4e3174736f5d5f42d04d90acabcb3
-
SHA512
aa3a0dac5c461fea5a2704984fde4bc6d7ddf9c6ce9d20c7bed7ba11cf24e8313804b6d16ec0430365c4e25c0d616e5bd3eaec48464bc26cf3698205fbacb6d2
-
SSDEEP
6144:KQy+bnr+up0yN90QE8LVuuyjnVdtwXKFxouT9M7n2lzIsTsir/U8r60iJBZ:IMriy90eLVuuyzPtXgu5Gn26eMZ
-
Detects Healer an antivirus disabler dropper
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1