Behavioral task
behavioral1
Sample
1996-58-0x0000000000400000-0x000000000041C000-memory.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
1996-58-0x0000000000400000-0x000000000041C000-memory.exe
Resource
win10v2004-20220812-en
General
-
Target
1996-58-0x0000000000400000-0x000000000041C000-memory.dmp
-
Size
112KB
-
MD5
16000d10476b23a0caea0204e0d2c690
-
SHA1
e3ebe7d6b0422c5421ba5aa62fefc880915aef59
-
SHA256
8e9f350f9e01e8bf6f0c130eb77a874912a1a53c457ab6b79f323ed315a6c7ab
-
SHA512
835bf4e392f3031aead7fc1c01ccc9cc667b22c917c9e501968f692602271a7864aa6076b33f832805cb98a67f40abee6a5958253eb22cd5633903eacf109c3c
-
SSDEEP
1536:4PqUPY5IyWjddJg398wbDw7kxhxDNWDNyNDnDNbiu6jyCrDN1Jv5DNPZvJ7Siq6i:PAExxhuDZ/+LRwwzD/KI
Malware Config
Extracted
redline
lyi
20.111.62.187:12944
-
auth_value
8ffd2302529fb16202ca986276400a97
Signatures
-
Redline family
Files
-
1996-58-0x0000000000400000-0x000000000041C000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 86KB - Virtual size: 85KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ