redline | 1992-61-0x00000000000C0000-0x00000000000E8000-memory[.]dmp

General

Target
1992-61-0x00000000000C0000-0x00000000000E8000-memory.dmp
Size 160KB
Sample220908-pfh7pseef2
SHA256 7b0a66645c56c1622bed57a769bfdec82b8cc9bf4aea9e02ab8381b352ac317d
MD5 7cf758ef3c780767420ea79c88f9201d
SHA1 1eba95d5e2d1cd48da52c56da654ffcacdb2e66d
SHA512 ffb9b208aa34167179dbc21138c33d44c55d87d15847dec87907fc7cb15ae1376ff141173c5eba6eb6286c93d8e3767631223c6cf761ebe86d41204461915e8b
SSDEEP 3072:eYO/ZMTFgfCR2RAYQDOOVx3WrsVvaDF1GRPShpSS:eYMZMBgf2Yt4x3WFGpSh
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

0809_0x00 redline

Malware Config

Extracted

Family

redline

Botnet

0809_0x00

C2

ns3.livelogs.xyz:81

Attributes

auth_value
4732d4c9e02e87fffadfade3615428cf

Signatures

RedLine payload 1 IoCs

resource	yara_rule
sample	family_redline

Redline family
redline

File Explorer

1992-61-0x00000000000C0000-0x00000000000E8000-memory.dmp

.exe 160KB

1992-61-0x00000000000C0000-0x00000000000E8000-memory.dmp

SHA256 7b0a66645c56c1622bed57a769bfdec82b8cc9bf4aea9e02ab8381b352ac317d
MD5 7cf758ef3c780767420ea79c88f9201d
SHA1 1eba95d5e2d1cd48da52c56da654ffcacdb2e66d
SHA512 ffb9b208aa34167179dbc21138c33d44c55d87d15847dec87907fc7cb15ae1376ff141173c5eba6eb6286c93d8e3767631223c6cf761ebe86d41204461915e8b
SSDEEP 3072:eYO/ZMTFgfCR2RAYQDOOVx3WrsVvaDF1GRPShpSS:eYMZMBgf2Yt4x3WFGpSh
MD5 SHA1 SHA512 SSDEEP

windows x86

RedLine payload

Minor OS version

Major OS version

Entry point

139578

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Sharing