Behavioral task
behavioral1
Sample
98760-56-0x0000000000400000-0x000000000041C000-memory.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
98760-56-0x0000000000400000-0x000000000041C000-memory.exe
Resource
win10v2004-20220812-en
General
-
Target
98760-56-0x0000000000400000-0x000000000041C000-memory.dmp
-
Size
112KB
-
MD5
6f4e7b3ce07c8056dad14101d6e96d79
-
SHA1
07e528146c9b7d96c74cddbca1a902886a4ded56
-
SHA256
ab55ab16e9444fb5fb0252c157fc3a4800608a9d9eae478d578014c6e28df436
-
SHA512
660255b75d1489353e9eb3e29376f678c26c1c718b8dd4333ba58d1c667fb8ce26505bb2b0bb56d20d93c8057798454f1b8f5ece4b7d696e3172694a87bf5ed1
-
SSDEEP
3072:TJ6QI49LfTVNu8zvcT54U7OGDn+jvTLu:TJVbfTVN3
Malware Config
Extracted
redline
PABLO777
77.73.134.2:4427
-
auth_value
9c12a1edf4eabad70a6e32b224f6a087
Signatures
-
Redline family
Files
-
98760-56-0x0000000000400000-0x000000000041C000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 87KB - Virtual size: 87KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ