Behavioral task
behavioral1
Sample
1904-1274-0x0000000000B10000-0x0000000000B42000-memory.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
1904-1274-0x0000000000B10000-0x0000000000B42000-memory.exe
Resource
win10v2004-20230220-en
General
-
Target
1904-1274-0x0000000000B10000-0x0000000000B42000-memory.dmp
-
Size
200KB
-
MD5
5cd2558c1ee759d20f0f9cbe015e6f3a
-
SHA1
ca04d7bee219b58da1375f0eceddba461a611bcb
-
SHA256
0060142a278a52db9265959fe7d2992a6dc17430ec7a9309a6b560814625918e
-
SHA512
71e401f6f947b518a99948be036766c22b1737dc62e26eb9adc1ce264c10b4a6dc8c8ff73ec218195598cc84b0feb7e3b964c18a0fc135cc9139ef25980482b8
-
SSDEEP
3072:wxqZWRZaPkOQ3rbep5FCh16xNn2pU9f2MKTV/wi4lr55R9TxlnsPsUw0jOuw+caH:eqZorYCh
Malware Config
Extracted
redline
0001
195.133.40.209:13527
-
auth_value
ecf595ee61db151a311a574809480fe7
Signatures
-
Redline family
Files
-
1904-1274-0x0000000000B10000-0x0000000000B42000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 105KB - Virtual size: 104KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 68KB - Virtual size: 67KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ