redline | 4008-127-0x0000000004090000-0x00000000040C4000-memory[.]dmp | Triage

Sharing

Copy URL Twitter E-mail

General

Target

4008-127-0x0000000004090000-0x00000000040C4000-memory.dmp
Size

208KB
MD5

09942e6237faee354732369cd5011283
SHA1

88812662eafaef6186079b98d9feaa97f3d74c9a
SHA256

c8ff57ba53f11391ddd009e67e04e0d8c6fe8807c6da413ba7c663498c5f796d
SHA512

926e3d401eace348cf5f6cc5dfd85fdf34e5a92701d67d9f19e3a7b179019624a5fbcec8816765ba1a03746404c1382baf79f90238067846b92933fbee710e78
SSDEEP

3072:mqns695m5jVHLoE0B2BXkrmK7lw7Lo4+PnzL/8e8hQZN:7ns6CjVHLK/laLozPFN

Score

10^/10

logsdiller cloud (telegram: @logsdillabot)redline

Malware Config

Extracted

Family

redline

Botnet

LogsDiller Cloud (Telegram: @logsdillabot)

C2

51.89.201.49:6932

Attributes

auth_value
c2955ed3813a798683a185a82e949f88

Signatures

Redline family
redline

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4008-127-0x0000000004090000-0x00000000040C4000-memory.dmp

Files

4008-127-0x0000000004090000-0x00000000040C4000-memory.dmp
.exe windows x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 150KB - Virtual size: 149KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 39KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ