Behavioral task
behavioral1
Sample
1648-56-0x0000000000400000-0x0000000000430000-memory.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
1648-56-0x0000000000400000-0x0000000000430000-memory.exe
Resource
win10v2004-20221111-en
General
-
Target
1648-56-0x0000000000400000-0x0000000000430000-memory.dmp
-
Size
192KB
-
MD5
91da78c58cee56c85f6131c451546541
-
SHA1
e0c9fdc1a4540d16bb3f9715bb90cbfee6951ee1
-
SHA256
cf695f1ec9754919b84214da2956e12cfd28156e9cb007b6c528199f57a3d54c
-
SHA512
bac3d581a96979e364e7db0e82f86b0bdb312792fab816bb24d2b60b1bdec85caf7e2bf4752548ca083099f8504367db2a7bbda5f134e68dee111726f54d5acb
-
SSDEEP
3072:/qaXm74qpXtmOnJjBawT253uaxfKfVvXgDOL3DvpPL0F0JCb3O3Cb3hzmzUEcC8/:xsfBHTTrh
Malware Config
Extracted
redline
82.115.223.45:81
-
auth_value
c2fe7317fe7ff4f824b33703ad0f4c01
Signatures
-
Redline family
Files
-
1648-56-0x0000000000400000-0x0000000000430000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 103KB - Virtual size: 103KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 68KB - Virtual size: 67KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ