Behavioral task
behavioral1
Sample
840-58-0x0000000000400000-0x000000000041C000-memory.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
840-58-0x0000000000400000-0x000000000041C000-memory.exe
Resource
win10v2004-20220812-en
General
-
Target
840-58-0x0000000000400000-0x000000000041C000-memory.dmp
-
Size
112KB
-
MD5
18acb724e8f0341172f04d68924e93a6
-
SHA1
1529cf728795d312cb3e99e09d8e6350e871dcbb
-
SHA256
69abe9c3fa9d409826f433115867edd0dec7744113238ffce8f78bd02ff227d9
-
SHA512
4d92a19b166a1f0c4f20e601ac6c863668760e6590d8b1b0e64494c382e60f8874b982659a8cd4aeff5aa551a2f28f1a78c5df554a03ae3d702900da61578a6d
-
SSDEEP
1536:XPqUPY5oyWjddJg3d3ubDd4ye2DNeDNXNDqDNaiuBjyC4DN1DvyDNPqAJ7WiXihi:aruZehOqJiMfJTmSZy+E44I
Malware Config
Extracted
redline
@joker_reborn
20.111.62.187:12944
-
auth_value
3bef5f3e00b75e26d1f1fc60672cd81d
Signatures
-
Redline family
Files
-
840-58-0x0000000000400000-0x000000000041C000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 86KB - Virtual size: 85KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ