General

  • Target

    3052-816-0x0000000000F50000-0x0000000000F8E000-memory.dmp

  • Size

    248KB

  • MD5

    e3fcbd8e9d22c25360ad5e9e05cff76a

  • SHA1

    7dee8b7faeeff0651aea959421399ba4703669af

  • SHA256

    6acafcb6833f27be63e134a79b36129b7366bab6cdfe7a581419da5448523def

  • SHA512

    5403d7aaaa0dbc1ad2073c9a2dcafa079b9c256c24d047a526e2205eb54d62e6f279f6f42027050d27e3b58c43607c963d6534e067e12efd04e0c7da2253ed41

  • SSDEEP

    3072:j2PLqOze7nDNgcYde+t9P/Kt/qbe9aKC9GYYOtLDA:j0Lm7DNgc8vtO/D9aKC9V5tL

Score
10/10

Malware Config

Extracted

Family

redline

Botnet

clientfile

C2

194.180.49.159:80

Signatures

  • RedLine payload 1 IoCs
  • Redline family
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 3052-816-0x0000000000F50000-0x0000000000F8E000-memory.dmp
    .exe windows:4 windows x86


    Headers

    Sections