redline | 1472-532-0x0000000004D90000-0x0000000004DCC000-memory[.]dmp | Triage

Sharing

General

Target

1472-532-0x0000000004D90000-0x0000000004DCC000-memory.dmp
Size

240KB
MD5

13eac3a5b2f6b84af814e7406eb9521c
SHA1

f838271987ff574b128b0a44dc09d0f296ccff86
SHA256

26183ea541e0ee50801d7f49b1d86c7c651222ee703851cf8cefbb19e3e0e426
SHA512

493699380c0c1b3088e5c496467aeb5597eed144dc66a1306b9147b8e679b4b4f66b10af7d6cd510ad490b3455ab17f3227ed1a8a034cddafa1f1f9cbab1ad0c
SSDEEP

3072:jjqrLUeDQRiORL49P84HHmQNcor5KjGmhoe/uxxgChG5OA9paZwJGEKH:jjq3+iR3HH1NpdWlEeChg9paZF

Score

10^/10

slovarik1btc redline

Malware Config

Extracted

Family

redline

Botnet

slovarik1btc

C2

78.153.144.3:2510

Attributes

auth_value
69236173f96390de00bb5a5120a1f3a0

Signatures

RedLine payload 1 IoCs

resource	yara_rule
sample	family_redline

Redline family
redline

Files

1472-532-0x0000000004D90000-0x0000000004DCC000-memory.dmp
.exe windows x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 212KB - Virtual size: 212KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ