Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Behavioral task
behavioral1
Sample
07d4b7768e13d79ac5f05f81167b29bb6fbf97828a289d8d11eec38939846834.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
07d4b7768e13d79ac5f05f81167b29bb6fbf97828a289d8d11eec38939846834.exe
Resource
win10-20240404-en
General
-
Target
07d4b7768e13d79ac5f05f81167b29bb6fbf97828a289d8d11eec38939846834
-
Size
304KB
-
MD5
58e8b2eb19704c5a59350d4ff92e5ab6
-
SHA1
171fc96dda05e7d275ec42840746258217d9caf0
-
SHA256
07d4b7768e13d79ac5f05f81167b29bb6fbf97828a289d8d11eec38939846834
-
SHA512
e7655762c5f2d10ec246d11f82d437a2717ad05be847b5e0fd055e3241caaca85430f424055b343e3a44c90d76a0ba07a6913c2208f374f59b61f8aa4477889f
-
SSDEEP
3072:Eq6EgY6iArUjOvWUJwPYT8QADFKoRJTA+tJSiK1cZqf7D34leqiOLibBOT:vqY6iULwP/xnRJTAKJ81cZqf7DIvL
Malware Config
Extracted
redline
newbundle2
185.215.113.67:15206
Signatures
-
RedLine payload 1 IoCs
resource yara_rule sample family_redline -
Redline family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 07d4b7768e13d79ac5f05f81167b29bb6fbf97828a289d8d11eec38939846834
Files
-
07d4b7768e13d79ac5f05f81167b29bb6fbf97828a289d8d11eec38939846834.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 187KB - Virtual size: 186KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 115KB - Virtual size: 114KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ