Behavioral task
behavioral1
Sample
924-83-0x00000000007D0000-0x0000000000800000-memory.exe
Resource
win7-20230703-en
Behavioral task
behavioral2
Sample
924-83-0x00000000007D0000-0x0000000000800000-memory.exe
Resource
win10v2004-20230703-en
General
-
Target
924-83-0x00000000007D0000-0x0000000000800000-memory.dmp
-
Size
192KB
-
MD5
8eff21f65e92f3731f548a0b36d1a622
-
SHA1
f635a4c6e0ea4f33b0e51adb862357d64c10ab5c
-
SHA256
7c8394a638212148f87819504d094af88465e92a0a348d8264654c8fc17370b3
-
SHA512
6f32b521f0a8a633ee7389f69c4a87c585c34e07f1f32b1685ea2a279c49558bc709b91c7746161cd3ac0dea7b6efef6da9a5a6e0514cfd440d040fb53df6d7a
-
SSDEEP
3072:cN9zgaHeuGhriktrBxN3kuZ+zdzu8e8hj:69Ie4rhTodzu
Malware Config
Extracted
redline
furod
77.91.68.70:19073
-
auth_value
d2386245fe11799b28b4521492a5879d
Signatures
-
Redline family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 924-83-0x00000000007D0000-0x0000000000800000-memory.dmp
Files
-
924-83-0x00000000007D0000-0x0000000000800000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 132KB - Virtual size: 131KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 39KB - Virtual size: 38KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ