Behavioral task
behavioral1
Sample
1100-59-0x0000000000400000-0x000000000045A000-memory.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
1100-59-0x0000000000400000-0x000000000045A000-memory.exe
Resource
win10v2004-20221111-en
General
-
Target
1100-59-0x0000000000400000-0x000000000045A000-memory.dmp
-
Size
360KB
-
MD5
8d2f13ce1d366c9d7d7ef137db5ecdec
-
SHA1
b558a1f16837a49952e56c0a4630e42587297e0d
-
SHA256
727f5984ae52567598ffab47d1616f735827a41fe3b649396b5d19ccac2ad1f1
-
SHA512
2fad285db78367a86c349c9b14f24fcc0f068f5a58aecd12f8d7daea200a1da63fa5b88e300ef33bcf697e1716a811d6d72a35be20e6722570a199d968c13adf
-
SSDEEP
6144:I34UtqIjJFzu8SDM482oignUaR/zXcRUWgnCQY+bRnOo:oaMdsRUWgnCQY+bRnOo
Malware Config
Extracted
redline
TORRENTOLD
amrican-sport-live-stream.cc:4581
-
auth_value
74e1b58bf920611f04c0e3919954fe05
Signatures
-
Redline family
Files
-
1100-59-0x0000000000400000-0x000000000045A000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 267KB - Virtual size: 267KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 68KB - Virtual size: 67KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ