Behavioral task
behavioral1
Sample
1188-56-0x0000000000400000-0x0000000000430000-memory.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
1188-56-0x0000000000400000-0x0000000000430000-memory.exe
Resource
win10v2004-20230221-en
General
-
Target
1188-56-0x0000000000400000-0x0000000000430000-memory.dmp
-
Size
192KB
-
MD5
c42f548f9045b2e67435655ff67098a8
-
SHA1
40232ad80033d22868cd779081d0d367e7c776fd
-
SHA256
8ec44e9c4659bcf82df07c4520b2df9bd6efd5831a64975778d5616d7d78333b
-
SHA512
a84ee60e242a5daf2b358bdd12c76b3f565c5574c940615a87d1d047efb46f57ea383bc5a67de51c3217baff793bf5f634ad3fe580517134b13cad46f5e4ea48
-
SSDEEP
3072:8qaFm74qpXtmOnJjBawT253uaxfKfVvXgDOL3D1pPL0F0JCb3O3Cb3hFoFIEcC8r:YsfzUcLh
Malware Config
Extracted
redline
45.15.157.131:36457
-
auth_value
e2b8fca520cd9a12cc348212c33d4ea6
Signatures
-
Redline family
Files
-
1188-56-0x0000000000400000-0x0000000000430000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 103KB - Virtual size: 103KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 68KB - Virtual size: 67KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ