Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
file.exe
-
Size
1.0MB
-
Sample
240829-rwva1swhkb
-
MD5
abb713cf90e8345c0b6b79345cbdc9d6
-
SHA1
67e705d4070b58994f0b718005d5f07fef824192
-
SHA256
bfe19615479cff03ad963d8206c2e3e89ddafd30bb4978e27976295214d3f295
-
SHA512
809b8c6aae46674c4c5fe24a98ae1fa065ab24d44c42e56b85946d7cc039f4139eb34e62daaf2ea1058180884a72c411d639c79eacc491e7fdb555a11b4dd524
-
SSDEEP
24576:T3ThU20saWF461GGhJryB+dItlXPoxt1tXNq7pk04o9wynZTAgEXt:7OcXDGG/uua1Y3XwpkkagGt
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20240802-en
Malware Config
Extracted
redline
LogsDiller Cloud (TG: @logsdillabot)
147.45.47.251:2149
Targets
-
-
Target
file.exe
-
Size
1.0MB
-
MD5
abb713cf90e8345c0b6b79345cbdc9d6
-
SHA1
67e705d4070b58994f0b718005d5f07fef824192
-
SHA256
bfe19615479cff03ad963d8206c2e3e89ddafd30bb4978e27976295214d3f295
-
SHA512
809b8c6aae46674c4c5fe24a98ae1fa065ab24d44c42e56b85946d7cc039f4139eb34e62daaf2ea1058180884a72c411d639c79eacc491e7fdb555a11b4dd524
-
SSDEEP
24576:T3ThU20saWF461GGhJryB+dItlXPoxt1tXNq7pk04o9wynZTAgEXt:7OcXDGG/uua1Y3XwpkkagGt
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Credentials from Password Stores: Credentials from Web Browsers
Malicious Access or copy of Web Browser Credential store.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates processes with tasklist
-
MITRE ATT&CK Enterprise v15
Defense Evasion
Modify Registry
1Subvert Trust Controls
1Install Root Certificate
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
2Credentials In Files
2