Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
4a7a6d2953344489e7d7efc811832551098870b44b2820495685d3d0040c0b87
-
Size
743KB
-
Sample
230910-kcvzwafh23
-
MD5
f2c6b3bf6afc1c7daca5a993ed7f302e
-
SHA1
2b08e6557162dfafd067cad9d5f21c301fdc9bdc
-
SHA256
4a7a6d2953344489e7d7efc811832551098870b44b2820495685d3d0040c0b87
-
SHA512
a828dd6e86065af17a60b294a7b6ff62a1bbd83e095929e372678e082f70550c8c7a0b147d789221755d9b77e2285d186e2d452fdcdcc47d47d597460a2d9fb9
-
SSDEEP
12288:QMrIy90vcXz5Mrl2JPi9zXL7RCeVAg6cI4TpjTUa0J6gIoPPBMxIrH:Iy762JmRC+4z4Tu/YgIy0+H
Static task
static1
Behavioral task
behavioral1
Sample
4a7a6d2953344489e7d7efc811832551098870b44b2820495685d3d0040c0b87.exe
Resource
win10v2004-20230831-en
Malware Config
Extracted
redline
virad
77.91.124.82:19071
-
auth_value
434dd63619ca8bbf10125913fb40ca28
Targets
-
-
Target
4a7a6d2953344489e7d7efc811832551098870b44b2820495685d3d0040c0b87
-
Size
743KB
-
MD5
f2c6b3bf6afc1c7daca5a993ed7f302e
-
SHA1
2b08e6557162dfafd067cad9d5f21c301fdc9bdc
-
SHA256
4a7a6d2953344489e7d7efc811832551098870b44b2820495685d3d0040c0b87
-
SHA512
a828dd6e86065af17a60b294a7b6ff62a1bbd83e095929e372678e082f70550c8c7a0b147d789221755d9b77e2285d186e2d452fdcdcc47d47d597460a2d9fb9
-
SSDEEP
12288:QMrIy90vcXz5Mrl2JPi9zXL7RCeVAg6cI4TpjTUa0J6gIoPPBMxIrH:Iy762JmRC+4z4Tu/YgIy0+H
-
Detects Healer an antivirus disabler dropper
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Executes dropped EXE
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1