Behavioral task
behavioral1
Sample
1584-55-0x0000000000400000-0x0000000000432000-memory.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
1584-55-0x0000000000400000-0x0000000000432000-memory.exe
Resource
win10v2004-20230221-en
General
-
Target
1584-55-0x0000000000400000-0x0000000000432000-memory.dmp
-
Size
200KB
-
MD5
3177c993c01ddff6a29d23b94fef6c02
-
SHA1
855282fb04feb777e89c4d7200af9442e09e85c7
-
SHA256
be1fc7c094592bd5c270564fc23223ad558930595ef3997b08935186566a8fa2
-
SHA512
f3abaf4d54621a11b762dc489fd97cac2683296c89b59ecf7f420e9c4f0f4f3c5873928c8eab386cda6fdfd763ebdd816df788b6540c1421305c5b39c897f466
-
SSDEEP
3072:J9xqZW2Ta9ApGvX5lCep59hh9bxNn2pU9f2MKTV/wi4lr55R9TxlnsPsUw0jOuwY:JHqZyJl/hh
Malware Config
Extracted
redline
135.181.173.163:4324
-
auth_value
a909e2aaecf96137978fea4f86400b9b
Signatures
-
Redline family
Files
-
1584-55-0x0000000000400000-0x0000000000432000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 105KB - Virtual size: 104KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 68KB - Virtual size: 67KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ