Behavioral task
behavioral1
Sample
1900-3050-0x0000000000CC0000-0x0000000000CF2000-memory.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
1900-3050-0x0000000000CC0000-0x0000000000CF2000-memory.exe
Resource
win10v2004-20230221-en
General
-
Target
1900-3050-0x0000000000CC0000-0x0000000000CF2000-memory.dmp
-
Size
200KB
-
MD5
42f455e43f4a188323ae5a811dd2058e
-
SHA1
d2a6f6ea80fbd8c995c77750701e0535cec354ff
-
SHA256
ff600761d5c1edb9045d86201bf420b08ae1ea6399e897a12dcaa538d4f3ebcb
-
SHA512
6e3b374bbe633b987d0d7f0bd3cb67b76bb21b5e01dd4992546c2857e3778691237bcd282fd43bcdc4c0d0fa72c24fd186b67e300a3e53af892c90402c6e657a
-
SSDEEP
3072:vxqZWzvagwoMR3I58ZlHeR5FthXrxNn2pU9f2MKTV/wi4lr55R9TxlnsPsUw0jOb:ZqZVY8qth
Malware Config
Extracted
redline
spora
176.113.115.145:4125
-
auth_value
441b39ab37774b2ca9931c31e1bc6071
Signatures
-
Redline family
Files
-
1900-3050-0x0000000000CC0000-0x0000000000CF2000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 105KB - Virtual size: 104KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 68KB - Virtual size: 67KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ