Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

empyra-setup.exe

windows7-x64

10

empyra-setup.exe

windows10-2004-x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    empyra-setup.exe

  • Size

    51.5MB

  • Sample

    231105-1gpxesda7s

  • MD5

    37ce00f8e12de66ae06cd62bf019bd99

  • SHA1

    0b2dcd13bd84908c1f737de9e3f2cb9c7836a95e

  • SHA256

    50f7819d7c68fa53847985279243b2cc8fe7489b9fef4354dddee05e57891361

  • SHA512

    f15a1501af455cf1ce2a0591ac861eef33515b07e0ca92ee18043b37d72a640acab17d77a0813e60bab23fbb04c805288f6a21892280c959cc910280255829d0

  • SSDEEP

    786432:b4wGjlJrrrK0WObuBKm4/3j1l62v7CkAwBMzD1BxtTVDLMiQP:Sl1rrEZlil62WkAoGZxdLMd

Score
10/10
redlinediscoveryinfostealer

Malware Config

Targets

    • Target

      empyra-setup.exe

    • Size

      51.5MB

    • MD5

      37ce00f8e12de66ae06cd62bf019bd99

    • SHA1

      0b2dcd13bd84908c1f737de9e3f2cb9c7836a95e

    • SHA256

      50f7819d7c68fa53847985279243b2cc8fe7489b9fef4354dddee05e57891361

    • SHA512

      f15a1501af455cf1ce2a0591ac861eef33515b07e0ca92ee18043b37d72a640acab17d77a0813e60bab23fbb04c805288f6a21892280c959cc910280255829d0

    • SSDEEP

      786432:b4wGjlJrrrK0WObuBKm4/3j1l62v7CkAwBMzD1BxtTVDLMiQP:Sl1rrEZlil62WkAoGZxdLMd

    Score
    10/10
    redlinediscoveryinfostealer

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • .NET Reactor proctector

      Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks