Behavioral task
behavioral1
Sample
924-58-0x0000000000400000-0x000000000042E000-memory.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
924-58-0x0000000000400000-0x000000000042E000-memory.exe
Resource
win10v2004-20230220-en
General
-
Target
924-58-0x0000000000400000-0x000000000042E000-memory.dmp
-
Size
184KB
-
MD5
c17c4d230245b9e78defa9726ca28e6b
-
SHA1
a526189f96ec1e239e605e4d637ae7e018011723
-
SHA256
a282f3b1006134d6d83590146d2eedbd272d01b7c95ebfb6b5a5c6a0d89fa4fa
-
SHA512
8661bc14984cb7d8a777980b07753b5b2ef6bfdbe91c9496b28e8137d767f5846771731f6a16c997f78e6e0680bd6784c1f353352dc6dcd506ab6350ee7607f7
-
SSDEEP
1536:VtXBW+fr25g6Ivun01cMDxbd2k6hvuibV7w953lwyea:PA+T25dn01cyr2/hvhGbHr
Malware Config
Extracted
redline
w2
45.138.74.246:23202
-
auth_value
a26582048fd734d6cc58fd7df0c406c3
Signatures
-
Redline family
Files
-
924-58-0x0000000000400000-0x000000000042E000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 89KB - Virtual size: 88KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 68KB - Virtual size: 67KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ