Behavioral task
behavioral1
Sample
1324-56-0x0000000000400000-0x0000000000436000-memory.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
1324-56-0x0000000000400000-0x0000000000436000-memory.exe
Resource
win10v2004-20221111-en
General
-
Target
1324-56-0x0000000000400000-0x0000000000436000-memory.dmp
-
Size
216KB
-
MD5
b155ac8009562fafc396db473fcd8c8c
-
SHA1
bae585c2900c12c416490f32dcfd56c1468ffcc8
-
SHA256
47d54f73923212d423ea444810956c9fa16563778e0a4c0b5020f247e68f5aa4
-
SHA512
56e9344105394e01792fb248258f0003df06f17180d77d0956abbc12beee1c861e323e60fd03c228582612b6757e8995354326efea08f16a1b962cb3c7db41ff
-
SSDEEP
1536:+YtxKYnY0Nr6OqVj5CAWUhhY9zei0bXEebgyhepzur9tkadOUw1y/pbYY3GN:bvYT55gkh2M0MdkGkkrhpPGN
Malware Config
Extracted
redline
3
185.242.86.55:37832
-
auth_value
6d2d19febb55544b17de28698fd3b161
Signatures
-
Redline family
Files
-
1324-56-0x0000000000400000-0x0000000000436000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 88KB - Virtual size: 87KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 110KB - Virtual size: 109KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ