Behavioral task
behavioral1
Sample
1084-56-0x0000000002290000-0x00000000022C2000-memory.exe
Resource
win7-20220901-en
General
-
Target
1084-56-0x0000000002290000-0x00000000022C2000-memory.dmp
-
Size
200KB
-
MD5
3a87bceaf89e70f70971df64f6a65636
-
SHA1
53791d87967a4d24cae79c7ef92f6ce5d60fbf7e
-
SHA256
c66a5f3e46e67b7201e4ba85d2d28d76e58db8cffc196daf2888148ca1901121
-
SHA512
47cd4090b69d29b486ee92c765f0b972256922f970bca94596819f1959239580224cf2bccf9bb90c45ec5f5d6250c6f5e44850b6d082d8b324aeb0ce3daf2f8f
-
SSDEEP
3072:mxqZWonaxIF63bJqs3sw5ek29whzHxNn2pU9f2MKTV/wi4lr55R9TxlnsPsUw0jn:MqZ0bJq2fgwh
Malware Config
Extracted
redline
1
212.113.106.41:81
-
auth_value
a290efd4796d37556cc5af7e83c91346
Signatures
-
Redline family
Files
-
1084-56-0x0000000002290000-0x00000000022C2000-memory.dmp.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 105KB - Virtual size: 104KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 68KB - Virtual size: 67KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ