Behavioral task
behavioral1
Sample
1260-62-0x0000000000400000-0x000000000041C000-memory.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
1260-62-0x0000000000400000-0x000000000041C000-memory.exe
Resource
win10v2004-20220812-en
General
-
Target
1260-62-0x0000000000400000-0x000000000041C000-memory.dmp
-
Size
112KB
-
MD5
054e28f639942be649d7c5a5b0304186
-
SHA1
103865329a2992e677835b3fa99ce97eff2034ac
-
SHA256
c97a34f44a548f1dfedb3689b0a66e92e10f7a5312721e9a30b5bb077225cb87
-
SHA512
f7c7d89c907709701fdc1c4445eed75b517e5fb4334852c2a9ec75c8169c0865465add415e29f5b59e536d23c48549fa4477c0cd4b1c0b6388c0731e4f5a7376
-
SSDEEP
1536:K9Jwtp3WKvh3iWVMlmdK9yIVjVGGp4iHwbbr+ADHH+9PKom8lCqkG+/:6JM3iW9d6NmkchTH+9PKom88qkB
Malware Config
Extracted
redline
@joker_reborn
20.111.62.187:12944
-
auth_value
3bef5f3e00b75e26d1f1fc60672cd81d
Signatures
-
Redline family
Files
-
1260-62-0x0000000000400000-0x000000000041C000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 87KB - Virtual size: 86KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ