Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
1353a5a9f1482d0a879c477ccd34c0883604222ce57db39f42a47a5f8cdca1b2
-
Size
1.3MB
-
Sample
231011-jjqs3acb33
-
MD5
9acdd87879b14754ff03d1423ae4a8a3
-
SHA1
5c52b4800a1c87dd508e9335f061423291b2e6dc
-
SHA256
1353a5a9f1482d0a879c477ccd34c0883604222ce57db39f42a47a5f8cdca1b2
-
SHA512
63031fa82911bc2a0e6f562593d2779368a19d7de85aa5887447bae7fb93d862cdfe57d0070f765e3a718e2c8d7e62eec5e8f1550dcbdd91415c0e54e201105e
-
SSDEEP
24576:Zy1D8I3gs5twcYUg3deDNLcsoXdyKS0jj6gQn7VuO5l27jdPNfQjhaMoNS:MF8IQsLuUg3ucJBS0jhowOyPjfQjLe
Static task
static1
Behavioral task
behavioral1
Sample
1353a5a9f1482d0a879c477ccd34c0883604222ce57db39f42a47a5f8cdca1b2.exe
Resource
win7-20230831-en
Malware Config
Extracted
redline
gruha
77.91.124.55:19071
-
auth_value
2f4cf2e668a540e64775b27535cc6892
Extracted
amadey
3.89
http://77.91.68.52/mac/index.php
http://77.91.68.78/help/index.php
-
install_dir
fefffe8cea
-
install_file
explonde.exe
-
strings_key
916aae73606d7a9e02a1d3b47c199688
Targets
-
-
Target
1353a5a9f1482d0a879c477ccd34c0883604222ce57db39f42a47a5f8cdca1b2
-
Size
1.3MB
-
MD5
9acdd87879b14754ff03d1423ae4a8a3
-
SHA1
5c52b4800a1c87dd508e9335f061423291b2e6dc
-
SHA256
1353a5a9f1482d0a879c477ccd34c0883604222ce57db39f42a47a5f8cdca1b2
-
SHA512
63031fa82911bc2a0e6f562593d2779368a19d7de85aa5887447bae7fb93d862cdfe57d0070f765e3a718e2c8d7e62eec5e8f1550dcbdd91415c0e54e201105e
-
SSDEEP
24576:Zy1D8I3gs5twcYUg3deDNLcsoXdyKS0jj6gQn7VuO5l27jdPNfQjhaMoNS:MF8IQsLuUg3ucJBS0jhowOyPjfQjLe
-
Detect Mystic stealer payload
-
Detects Healer an antivirus disabler dropper
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1