Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
a67ab137351eb78f23e09d6ee1ba383e.exe
-
Size
263KB
-
Sample
231211-ccn8bsbcb9
-
MD5
a67ab137351eb78f23e09d6ee1ba383e
-
SHA1
2d58ca01095bf56f4b994856e155a8a6b884a761
-
SHA256
ddc048bac90461eba7c48f4b575e59f948650e0c42561d2faf48c3a78a519ebf
-
SHA512
9cf5fb7507086db68a4c4e6273e49cce3ff32c23492846c85db79040eccf165760de9b27bce4e8951d95da11fac5401b9a34c7e1334108cdb373aefa226e9124
-
SSDEEP
3072:Tn95L5elU5yxZG+vuo5Gs759Y16VGWh8V9KxcHzME9inuAg0FujrGiwf603IEBsi:J5LGK+2GJVGWh8rHHeuAOvEHlB5
Static task
static1
Behavioral task
behavioral1
Sample
a67ab137351eb78f23e09d6ee1ba383e.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
a67ab137351eb78f23e09d6ee1ba383e.exe
Resource
win10v2004-20231127-en
Malware Config
Extracted
smokeloader
2022
http://81.19.131.34/fks/index.php
Extracted
redline
LiveTraffic
77.105.132.87:6731
Extracted
redline
@oleh_ps
176.123.7.190:32927
Extracted
smokeloader
up3
Extracted
smokeloader
2020
http://host-file-host6.com/
http://host-host-file8.com/
Targets
-
-
Target
a67ab137351eb78f23e09d6ee1ba383e.exe
-
Size
263KB
-
MD5
a67ab137351eb78f23e09d6ee1ba383e
-
SHA1
2d58ca01095bf56f4b994856e155a8a6b884a761
-
SHA256
ddc048bac90461eba7c48f4b575e59f948650e0c42561d2faf48c3a78a519ebf
-
SHA512
9cf5fb7507086db68a4c4e6273e49cce3ff32c23492846c85db79040eccf165760de9b27bce4e8951d95da11fac5401b9a34c7e1334108cdb373aefa226e9124
-
SSDEEP
3072:Tn95L5elU5yxZG+vuo5Gs759Y16VGWh8V9KxcHzME9inuAg0FujrGiwf603IEBsi:J5LGK+2GJVGWh8rHHeuAOvEHlB5
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Suspicious use of SetThreadContext
-