Behavioral task
behavioral1
Sample
948-57-0x0000000000400000-0x0000000000436000-memory.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
948-57-0x0000000000400000-0x0000000000436000-memory.exe
Resource
win10v2004-20221111-en
General
-
Target
948-57-0x0000000000400000-0x0000000000436000-memory.dmp
-
Size
216KB
-
MD5
f9912be5a9d770c620fb532e249e9228
-
SHA1
39bad6ab7253cd3de950aa6bf8dccb4a36dc3018
-
SHA256
43e4a0fab2acd3a12d3b3cd45e88779ac5880e8dafe66c87787e80da560b4569
-
SHA512
29a33827c3079037d2bb43602c74408e43a7a4e3d7c3d37f12dd5040da6537ad3838a2d92467f7c4edd24c7a0829b329e2d9dd42259a375668ed689f45206122
-
SSDEEP
1536:3YAn64IaWTrk+VT5yL4HpeambXEeByymMpzurdtkadOUw1y/pbYY3GV:LgahA5ny0qDXmkkrhpPGV
Malware Config
Extracted
redline
@andriii_ff
176.124.220.67:30929
-
auth_value
525a7ad8080b3552f2f7735af7644111
Signatures
-
Redline family
Files
-
948-57-0x0000000000400000-0x0000000000436000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 88KB - Virtual size: 87KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 110KB - Virtual size: 109KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ