Behavioral task
behavioral1
Sample
432-66-0x0000000000400000-0x0000000000436000-memory.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
432-66-0x0000000000400000-0x0000000000436000-memory.exe
Resource
win10v2004-20220901-en
General
-
Target
432-66-0x0000000000400000-0x0000000000436000-memory.dmp
-
Size
216KB
-
MD5
8ce72ee9b49712bbdab75e74d5ce1dfe
-
SHA1
32f9ac77b364695f6096deacb054ade74a1a48f0
-
SHA256
832f59072950d4318b4ab5c5094ad7a2e772985aed4bcdf49eb7d5a5ec877e5a
-
SHA512
d21494a64c2b4baad759dfab1c58a66de5e1253899b594ea3694963a593b3fcee73abc3756da32a6f6630a8756dcc3f915857fbab7c21f3cb98d6a2325a20488
-
SSDEEP
1536:HYWYo/ha+BJrDKuI7/+mvSBvZnvwhKYEeUHbXEe5gylDpzurKt:6F+vE/vvCvZnQKf70WVBN
Malware Config
Extracted
redline
10.10.2022
65.21.9.53:38910
-
auth_value
077bd9da8f1046af12c2ca382df58370
Signatures
-
Redline family
Files
-
432-66-0x0000000000400000-0x0000000000436000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 88KB - Virtual size: 87KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 110KB - Virtual size: 109KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ