General

  • Target

    1860-167-0x0000000000400000-0x000000000041E000-memory.dmp

  • Size

    120KB

  • MD5

    d4b098d29e6373261cddcc456a8b32d9

  • SHA1

    3d8902532572ef7f7ec328da119ac30dc7a519f6

  • SHA256

    59d11a895189b3ad052ae709880a29b0ab932cc0befc634208f88b3d28d2c11f

  • SHA512

    eee7c85176794d7ed71f8dd89ca68f2df3e2604a21c9236efc611bf4156f0ac5857e70e57b9e91ab1e99b9102cf3af936a119a1d88a4fee2b3d912f919786311

  • SSDEEP

    1536:9qsINqLGlbG6jejoigI343Ywzi0Zb78ivombfexv0ujXyyed2x3teulgS6pY:rAMOY3+zi0ZbYe1g0ujyzd5Y

Score
10/10

Malware Config

Extracted

Family

redline

Botnet

cheat

C2

45.95.168.223:55615

Signatures

  • RedLine payload 1 IoCs
  • Redline family
  • SectopRAT payload 1 IoCs
  • Sectoprat family
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 1860-167-0x0000000000400000-0x000000000041E000-memory.dmp
    .exe windows x86


    Headers

    Sections