General

  • Target

    228-347-0x0000000000400000-0x0000000000428000-memory.dmp

  • Size

    160KB

  • MD5

    77b68f6dc6d6a3b4f23189f15c953948

  • SHA1

    5f16b79797aee037a29443e576cb32a9bd4842f6

  • SHA256

    cfd2b988f467572017c705cc1bad7f1c950d339fb591f407e4e296f145366a8c

  • SHA512

    fc5f8e691b2972f7ae8ceed7a36d35e548623897d882da5031fa1c22681b75edf2452b8cd3b18c545458aa13c2b8b5f4bf2bb2b587ed18471165015aa6afc9c1

  • SSDEEP

    3072:KYO/ZMTFNRbc5reHhv+oUSlVpDFHy1X5hJSSYP:KYMZMBNRbcsBv+oUSxAd5h

Malware Config

Extracted

Family

redline

Botnet

LogsDiller Cloud (Sup: @mr_golds)

C2

51.89.201.21:7161

Attributes
  • auth_value

    56c6f7b9024c076f0a96931453da7e56

Signatures

  • RedLine payload 1 IoCs
  • Redline family

Files

  • 228-347-0x0000000000400000-0x0000000000428000-memory.dmp
    .exe windows x86


    Headers

    Sections