Behavioral task
behavioral1
Sample
0x00080000000122f0-1060.exe
Resource
win7-20230220-en
General
-
Target
0x00080000000122f0-1060.dat
-
Size
175KB
-
MD5
3b08ef7181270d133cd63b373cdef49f
-
SHA1
d9ff21c9b15e18057873ad0f02c68ba1b86f0dc0
-
SHA256
a87b9fb76981b26067bb4246d1144e1c7544a63a610a68e291dc069f48402457
-
SHA512
a1e4e170d088fa0fcd9cc54102ba0f209c4bf8b956b70cdd12c55a30eede8801e3f3efc026043cfa246892c2a340aa1568838edfaee8147fefb87ff50e9cf719
-
SSDEEP
3072:kxqZWZRanU2n0YLxE3I4Ge/N9PhhPxNn2pU9f2MKTV/wi4lr55R9TxlnsPsUw0jr:6qZgYLx+r5Ph
Malware Config
Extracted
redline
luza
176.113.115.145:4125
-
auth_value
1261701914d508e02e8b4f25d38bc7f9
Signatures
-
Redline family
Files
-
0x00080000000122f0-1060.dat.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 105KB - Virtual size: 104KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 68KB - Virtual size: 67KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ