Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
autorun.exe
-
Size
1.0MB
-
Sample
231011-kwtadsef54
-
MD5
4e3304bd81a45a4a02d298dc508194c0
-
SHA1
b09d6899f03e48da77fee9e905741793064e116e
-
SHA256
613f058b34419fa46aaf71c61ec0afe963c133e023b6f75d889fb67395ddaf1b
-
SHA512
eecf0d026900af4157ec4f53428dd9af54ee29ca10187d08e9227f64265d6ac4c86a85bcb54bdc4f301d9ee8d842711db36653225c30a188073ed655ad44a901
-
SSDEEP
24576:YM573oyJAzoy99wIqjQfgia8gzhkxsWSPjmJRGYPVs:YM573oyy99wICQB22x/m
Static task
static1
Behavioral task
behavioral1
Sample
autorun.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
autorun.exe
Resource
win10v2004-20230915-en
Malware Config
Extracted
redline
unique285
194.169.175.232:45451
-
auth_value
1ed06994a9a19d3729019cb69c1f61a6
Targets
-
-
Target
autorun.exe
-
Size
1.0MB
-
MD5
4e3304bd81a45a4a02d298dc508194c0
-
SHA1
b09d6899f03e48da77fee9e905741793064e116e
-
SHA256
613f058b34419fa46aaf71c61ec0afe963c133e023b6f75d889fb67395ddaf1b
-
SHA512
eecf0d026900af4157ec4f53428dd9af54ee29ca10187d08e9227f64265d6ac4c86a85bcb54bdc4f301d9ee8d842711db36653225c30a188073ed655ad44a901
-
SSDEEP
24576:YM573oyJAzoy99wIqjQfgia8gzhkxsWSPjmJRGYPVs:YM573oyy99wICQB22x/m
Score10/10-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Uses the VBS compiler for execution
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Suspicious use of SetThreadContext
-