Behavioral task
behavioral1
Sample
2144-233-0x0000000000400000-0x0000000000432000-memory.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
2144-233-0x0000000000400000-0x0000000000432000-memory.exe
Resource
win10v2004-20220812-en
General
-
Target
2144-233-0x0000000000400000-0x0000000000432000-memory.dmp
-
Size
200KB
-
MD5
cfffbd3e56672a5f4e026a665b66d1d0
-
SHA1
a5b0404d5f10e1909e65605039ada79736bd3953
-
SHA256
4b88ff63ff342cca78acabe59e31194d0921771d001f03e852571d289e335b81
-
SHA512
65a9347ad8440e0b679208b43819017a67cbdc84403a85ab06fa17b89ddfdb51549c53bb66b112b283dc49c993c1694c1973230bd42ff4212dfd91ece74612a8
-
SSDEEP
3072:WxqZWBJaHEDgXvgmTUel7FihJHxNn2pU9f2MKTV/wi4lr55R9TxlnsPsUw0jOuwg:8qZVvgazih
Malware Config
Extracted
redline
letgo
80.66.87.13:22346
-
auth_value
9a4217b7e3f4309698e5e6d932e3545e
Signatures
-
Redline family
Files
-
2144-233-0x0000000000400000-0x0000000000432000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 105KB - Virtual size: 104KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 68KB - Virtual size: 67KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ