Behavioral task
behavioral1
Sample
1368-55-0x0000000000400000-0x000000000042E000-memory.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
1368-55-0x0000000000400000-0x000000000042E000-memory.exe
Resource
win10v2004-20230220-en
General
-
Target
1368-55-0x0000000000400000-0x000000000042E000-memory.dmp
-
Size
184KB
-
MD5
b76e79587707b4edda9dca189a05ad30
-
SHA1
3942f154b2f760cbd7085985b5c78f584bb651e9
-
SHA256
4296308e6cd4c09316bd2ef30011df8b2c7c9b29ba65c4b92c632d4fc3fe5145
-
SHA512
92359cb30dc2035eb625e68e140f6ca176e22a33efb81fedb0248f7fdf4be52d98ef7189d00716301ac010989ab25c5b85df86f289888e572b5b1bda3312fe93
-
SSDEEP
1536:pnDB7RsB0qnB5qlVZRGWb42rcdyRUjRjllqOETGqVGbu2YEDNmmSn83wYk48e8hK:pnmJUuYRMjDqVSXxmmSn68e8hK
Malware Config
Extracted
redline
135.181.241.192:4327
-
auth_value
a909e2aaecf96137978fea4f86400b9b
Signatures
-
Redline family
Files
-
1368-55-0x0000000000400000-0x000000000042E000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 128KB - Virtual size: 127KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 39KB - Virtual size: 38KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ