Overview

overview

10

Static

static

10

1048-56-0x...ry.exe

windows7-x64

10

1048-56-0x...ry.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    1048-56-0x0000000004BC0000-0x0000000004BE8000-memory.dmp

  • Size

    160KB

  • MD5

    f08a0a690129b8cf41baf9539ccd7c0b

  • SHA1

    15d2ea2261ccba448ab77174312d763df1a2d94a

  • SHA256

    471a67584d6dfca1e9fa398a1816aba11449409eed57bb6acdebed84978b58f0

  • SHA512

    909533b70f94355e742176dcff3b8bd80fad3f56c4594d41f62746b3b4195b244a84893d2f29ac8523c91667760c6eaea941e37f7355da478c46c521fea2453f

  • SSDEEP

    1536:2KqOtN6ba7o5LhpDyBvLs+L5+bYvHvNw69ksYgibfbFDKsR+:2eQHqjxLYUDnYgafJl+

Score
10/10
@chicagoredline

Malware Config

Extracted

Family

redline

Botnet

@Chicago

C2

185.81.68.115:2920

Attributes
  • auth_value

    624a75e46c4217bc2cafb7758d1978d9

Signatures

  • RedLine payload 1 IoCs
  • Redline family
    redline
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 1048-56-0x0000000004BC0000-0x0000000004BE8000-memory.dmp
    .exe windows x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections