redline | 976-55-0x00000000021B0000-0x00000000021F4000-memory[.]dmp | Triage

Sharing

General

Target

976-55-0x00000000021B0000-0x00000000021F4000-memory.dmp
Size

272KB
MD5

fe26a07c8ec5cf558e2a76bcdeeaff81
SHA1

18c11b4a25b42757efceb7b9e907127e3b8c0233
SHA256

a31f4bd7cefb9df46484a7c53c3ec1e411268a901b7490840c3ec11fd52943c1
SHA512

210da4ea186945864aecd4a47be8592cf6a31bc343e77f01fe682c71371e95e12dcaf2c84faf675a93785ce97654677bc7794db3f4001a6030cebfbba9eeca46
SSDEEP

3072:16jIELf6FDTCalB9M41vigXM+wXnMvLH9tho40BEl/hUinBTfTxNn2pU9f2MKTVl:16jo9TxpM+wXnMvLHR/hVnBQ

Score

10^/10

roma redline

Malware Config

Extracted

Family

redline

Botnet

roma

C2

193.233.20.7:4131

Attributes

auth_value
f099c2cf92834dbc554a94e1456cf576

Signatures

RedLine payload 1 IoCs

resource	yara_rule
sample	family_redline

Redline family
redline

Files

976-55-0x00000000021B0000-0x00000000021F4000-memory.dmp
.exe windows x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 178KB - Virtual size: 178KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 68KB - Virtual size: 67KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ