Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
2fba276996374b6496670b99dccb0a951955f19b223038fdc4dc2b718b1b8f7d
-
Size
8.8MB
-
Sample
240905-vszm4swerc
-
MD5
1ff3b20e1aef7a15845f531dbe52745e
-
SHA1
f88aa7c48885347a1067485821d5bc95f6c51b55
-
SHA256
2fba276996374b6496670b99dccb0a951955f19b223038fdc4dc2b718b1b8f7d
-
SHA512
df5dac5f54932189ab55ba7742e2d5d619ef387f61315f31cfd536a7f6e4389f8700c08f81563a25d24ee97bffa60f0b6dfa6c425989a8452b55486ea0ad064e
-
SSDEEP
196608:WNWvMDmI8qx5AxLg+mB6qDVKrNY+RpPOSdeIZ5yH+7BzLZMYFnIwBxu330HB5N:WaqWqx5YLg+y/DVKrNYCPoIZ5I+7B/2a
Static task
static1
Behavioral task
behavioral1
Sample
2fba276996374b6496670b99dccb0a951955f19b223038fdc4dc2b718b1b8f7d.exe
Resource
win10v2004-20240802-en
Malware Config
Extracted
redline
@topgcr
185.196.9.26:6302
Targets
-
-
Target
2fba276996374b6496670b99dccb0a951955f19b223038fdc4dc2b718b1b8f7d
-
Size
8.8MB
-
MD5
1ff3b20e1aef7a15845f531dbe52745e
-
SHA1
f88aa7c48885347a1067485821d5bc95f6c51b55
-
SHA256
2fba276996374b6496670b99dccb0a951955f19b223038fdc4dc2b718b1b8f7d
-
SHA512
df5dac5f54932189ab55ba7742e2d5d619ef387f61315f31cfd536a7f6e4389f8700c08f81563a25d24ee97bffa60f0b6dfa6c425989a8452b55486ea0ad064e
-
SSDEEP
196608:WNWvMDmI8qx5AxLg+mB6qDVKrNY+RpPOSdeIZ5yH+7BzLZMYFnIwBxu330HB5N:WaqWqx5YLg+y/DVKrNYCPoIZ5I+7B/2a
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Credentials from Password Stores: Credentials from Web Browsers
Malicious Access or copy of Web Browser Credential store.
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
MITRE ATT&CK Enterprise v15
Defense Evasion
Modify Registry
1Subvert Trust Controls
1Install Root Certificate
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
2Credentials In Files
2