Behavioral task
behavioral1
Sample
1008-60-0x0000000000400000-0x000000000045A000-memory.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
1008-60-0x0000000000400000-0x000000000045A000-memory.exe
Resource
win10v2004-20221111-en
General
-
Target
1008-60-0x0000000000400000-0x000000000045A000-memory.dmp
-
Size
360KB
-
MD5
ccb5e4e778796a001e99f9f1cb6bd9af
-
SHA1
9a628bd6c9441994605870c6d21b642a4d8c60ef
-
SHA256
4c7cfcca686bf0d2287f692c46a1fa65b61adee0297e1ad63ba2f14b9530f9ef
-
SHA512
8872769f978c03f867b333152b5a82679e26abcdf8dd2b973c5143fdb57aff6043cf150b58ec39dfc8fab65e02d4eb1d2dc82298a25fbee00b7f676565de050e
-
SSDEEP
6144:fiS+CDYBzzSxhWBD+bJ/eqNeGhJEi0QWURKZIM9XS37d+e+YqcXC9KsjY:fPcxzcY0bJ/D90V9XS37d+e+YqcXC9Kh
Malware Config
Extracted
redline
HEXO-SOFTWARE
amrican-sport-live-stream.cc:4581
-
auth_value
fea440ffae02b6f56d7b00fe8105ccb8
Signatures
-
Redline family
Files
-
1008-60-0x0000000000400000-0x000000000045A000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 268KB - Virtual size: 267KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 68KB - Virtual size: 67KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ