Behavioral task
behavioral1
Sample
2016-55-0x0000000000400000-0x0000000000430000-memory.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
2016-55-0x0000000000400000-0x0000000000430000-memory.exe
Resource
win10v2004-20230220-en
General
-
Target
2016-55-0x0000000000400000-0x0000000000430000-memory.dmp
-
Size
192KB
-
MD5
dd11514669f945eab702d90fd24babc6
-
SHA1
4563845802cbb1c45430396f30784d5ae59637c2
-
SHA256
d65198b1e187227360f6d58b31460d8abe6dd295ddbf4c0d5b97ebce908ce95f
-
SHA512
f054be16a74307da15a2ac15ed13cd67727f871b9974ef2a421392f00484afef8b26a4f6b5f25861d321e48e95a939e25b4e9550773975db81af52fdf9a67039
-
SSDEEP
3072:iqa9m74qpXtmOnJjBawT253uaxfKfVvXgDOL3D9pPL0F0JCb3O3Cb3hdgdoEcC8X:msfLXs4h
Malware Config
Extracted
redline
82.115.223.46:57672
-
auth_value
b5a5024cb3eeaf23221fa537fff7fcf5
Signatures
-
Redline family
Files
-
2016-55-0x0000000000400000-0x0000000000430000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 103KB - Virtual size: 103KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 68KB - Virtual size: 67KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ