redline | 2000-113-0x00000000002B0000-0x00000000002E0000-memory[.]dmp

General

Target
2000-113-0x00000000002B0000-0x00000000002E0000-memory.dmp
Size 192KB
Sample230702-hyjsmaah78
SHA256 18d30b530d249fa67d444d463ba5a6f9fb65e73c60d35bc3813b3bcb9af9fab4
MD5 ad638580c2702d88c1f90a6e80aad1b3
SHA1 06746bd5631285095901159a70fbfc111cc27b53
SHA512 607599cfa9c022e99f57f7d7a9b94debe7edd9dbfdc8a84db5455b60b5fdc43dfab279204112a310bc8921677b10abda9a64fd877ff431bb48f467cc76a6383e
SSDEEP 3072:rnOrlpyS3xp5xN1yJ/4BMzxUdE/J8e8h+:rOf7flBMzxUdE/J
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

narko redline

Malware Config

Extracted

Family

redline

Botnet

narko

C2

83.97.73.134:19071

Attributes

auth_value
a9d8c6db81c7e486f5832bc2ee48cb84

Signatures

Redline family
redline

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2000-113-0x00000000002B0000-0x00000000002E0000-memory.dmp

File Explorer

2000-113-0x00000000002B0000-0x00000000002E0000-memory.dmp

.exe 192KB

2000-113-0x00000000002B0000-0x00000000002E0000-memory.dmp

SHA256 18d30b530d249fa67d444d463ba5a6f9fb65e73c60d35bc3813b3bcb9af9fab4
MD5 ad638580c2702d88c1f90a6e80aad1b3
SHA1 06746bd5631285095901159a70fbfc111cc27b53
SHA512 607599cfa9c022e99f57f7d7a9b94debe7edd9dbfdc8a84db5455b60b5fdc43dfab279204112a310bc8921677b10abda9a64fd877ff431bb48f467cc76a6383e
SSDEEP 3072:rnOrlpyS3xp5xN1yJ/4BMzxUdE/J8e8h+:rOf7flBMzxUdE/J
MD5 SHA1 SHA512 SSDEEP

windows x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

143294

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Sharing