Behavioral task
behavioral1
Sample
2040-54-0x0000000000220000-0x0000000000246000-memory.exe
Resource
win7-20230220-en
General
-
Target
2040-54-0x0000000000220000-0x0000000000246000-memory.dmp
-
Size
152KB
-
MD5
c4f5d4893bb98e78353309c70c0e2e96
-
SHA1
3cce446c3b335cc8cd0610ee6e3defdb23e0140b
-
SHA256
d4425a847c97bd3e413be1b9c8125d4e688f37e09af6efd66b0dea0d9ca7c961
-
SHA512
bd998da67ff00bc363f1f91260b00a596a4fd5d92f64999dd7f7850a76a081bb8eda089ffa645446ca5ab38411bafa905fefdd011704023c5c53ae91056a8e5f
-
SSDEEP
1536:EaTcnVHT1i/o43poQ+fP/jMgZoBSVuBIOhZjfybV7yPOjxUsYgibfbFDKsRe:xTcZZM6PjMrkuR5GoW7YgafJle
Malware Config
Extracted
redline
my cloud yt
176.123.9.85:16482
-
auth_value
19019264f41e17d73a46cd93a41891bf
Signatures
-
Redline family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2040-54-0x0000000000220000-0x0000000000246000-memory.dmp
Files
-
2040-54-0x0000000000220000-0x0000000000246000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 88KB - Virtual size: 88KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 37KB - Virtual size: 37KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ