Overview

overview

10

Static

static

10

668-127-0x...ry.exe

windows7-x64

668-127-0x...ry.exe

windows10-2004-x64

Sharing

Copy URL
Twitter E-mail

General

  • Target

    668-127-0x0000000000090000-0x00000000000BE000-memory.dmp

  • Size

    184KB

  • MD5

    71653c42afa084e3e6374b4baf2d75c1

  • SHA1

    1f476eab4b9ff73fe4ad4410283e1d3b60805c2d

  • SHA256

    7023dedfa3dc2b5706eb98b7849efc5866f8594ff18cc3083a367b1e3eeda328

  • SHA512

    4cb7b2f5b48aa2c4f669bfc505adc7cf5f8062c7655323d1ed544304cc73706171378002cf3f89ae58e0f282b8c60d3a5fd6dfc8cfe6792109e4449498ec8bb1

  • SSDEEP

    3072:loXvu48Wqt0qzaMa2BlqVUYY69og68e8hx:2XCuRwlDQog6

Score
10/10
nitroredline

Malware Config

Extracted

Family

redline

Botnet

nitro

C2

83.97.73.127:19045

Attributes
  • auth_value

    1b68cf84b9b046f28b71cb39e44aa0e4

Signatures

  • Redline family
    redline
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 668-127-0x0000000000090000-0x00000000000BE000-memory.dmp
    .exe windows x86


    Headers

    Sections