Behavioral task
behavioral1
Sample
3236-259-0x0000000000BF0000-0x0000000000C22000-memory.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
3236-259-0x0000000000BF0000-0x0000000000C22000-memory.exe
Resource
win10v2004-20230220-en
General
-
Target
3236-259-0x0000000000BF0000-0x0000000000C22000-memory.dmp
-
Size
200KB
-
MD5
b346f5ee924d47582db774e884010fb9
-
SHA1
696553dbe1ca7dd367b2b38bfa8bf49b2ee317a1
-
SHA256
511ead714104249d9a51b3efca720de177f06347ec976643510804263b99f1a3
-
SHA512
4ca5fe63d69e21a46f0c456eb71abc5a6ad60cbc465cf3b9b2ff30239fa1589303f8757fc36df54afef6071f5dc9e19afe051dd47ce5388770bb36138adb6802
-
SSDEEP
3072:qxqZWBRanU2n09Kk68I/e539ihvTxNn2pU9f2MKTV/wi4lr55R9TxlnsPsUw0jOr:YqZY9KLHWih
Malware Config
Extracted
redline
02-700-2
167.235.133.96:43849
-
auth_value
8af50b3310e79fa317eef66b1e92900f
Signatures
-
Redline family
Files
-
3236-259-0x0000000000BF0000-0x0000000000C22000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 105KB - Virtual size: 104KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 68KB - Virtual size: 67KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ