Behavioral task
behavioral1
Sample
1984-199-0x0000000000B00000-0x0000000000B36000-memory.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
1984-199-0x0000000000B00000-0x0000000000B36000-memory.exe
Resource
win10v2004-20221111-en
General
-
Target
1984-199-0x0000000000B00000-0x0000000000B36000-memory.dmp
-
Size
216KB
-
MD5
ff71bc018a7769ea211e097b4a87a487
-
SHA1
773540333dd040b4fa2eefd904802c0e11a835cd
-
SHA256
8fac238e8ac069526cd0e4e055ec1c6e78a2382bff85af06b01dcd4d464d8eda
-
SHA512
176432aeebd1e520a305e7ba46cc0c53e119ab32d2b984d0b14d3bc96dae5be6f81395bd83cffce35f71d7b24afc15f932554a4b30cd109e9256c82bda29bc63
-
SSDEEP
1536:lYF1qd1WeQreHKltSBWqauPectpbXEe3gyO9pzurVtsadOUw1y/pbYY3GN:i4WC+SBWedf0oV2eskrhpPGN
Malware Config
Extracted
redline
installs
89.23.96.2:7253
-
auth_value
8d4428f372143572364f044ea9649d7f
Signatures
-
Redline family
Files
-
1984-199-0x0000000000B00000-0x0000000000B36000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 88KB - Virtual size: 87KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 110KB - Virtual size: 109KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ