redline | 2556-34-0x00000000001C0000-0x00000000001F0000-memory[.]dmp

General

Target
2556-34-0x00000000001C0000-0x00000000001F0000-memory.dmp
Size 192KB
Sample231013-d3k42aee45
SHA256 cb44927decf2fe9a008f9f71908205879fc9922b264c3c84e2574ff2a4557a0e
MD5 4795c20e4139ea458ec0bdd438e87c0d
SHA1 c64aaf5dab4be9186c7447dcad2a95d48326087a
SHA512 0dcad2193e58c6576e2340aaf464dd7a104cfdb5d4293b1d9c5df09caf064029699d3fc1b199743508a3e4a5c576ce009f466d36302569c1da295df9db860892
SSDEEP 3072:8w8wJp8A/xdimI06X7vV6OPEsUc/W0E0ilHPgM1JA8e8h3:8NzAmmI0k7vVe0E0YIM1e
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

lux3 redline

Malware Config

Extracted

Family

redline

Botnet

lux3

C2

176.123.9.142:14845

Attributes

auth_value
e94dff9a76da90d6b000642c4a52574b

Signatures

Redline family
redline

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2556-34-0x00000000001C0000-0x00000000001F0000-memory.dmp

File Explorer

2556-34-0x00000000001C0000-0x00000000001F0000-memory.dmp

.exe 192KB

2556-34-0x00000000001C0000-0x00000000001F0000-memory.dmp

SHA256 cb44927decf2fe9a008f9f71908205879fc9922b264c3c84e2574ff2a4557a0e
MD5 4795c20e4139ea458ec0bdd438e87c0d
SHA1 c64aaf5dab4be9186c7447dcad2a95d48326087a
SHA512 0dcad2193e58c6576e2340aaf464dd7a104cfdb5d4293b1d9c5df09caf064029699d3fc1b199743508a3e4a5c576ce009f466d36302569c1da295df9db860892
SSDEEP 3072:8w8wJp8A/xdimI06X7vV6OPEsUc/W0E0ilHPgM1JA8e8h3:8NzAmmI0k7vVe0E0YIM1e
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

145182

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Sharing