General

  • Target

    2620-226-0x00000000008D0000-0x00000000008EE000-memory.dmp

  • Size

    120KB

  • MD5

    553db9c5a3bfe235060c244b07ec01c8

  • SHA1

    bed838caa3771cc34bca76257472de5016946c69

  • SHA256

    f95accdbae70eac3ebaac64de35ba5db54a4c9024deb2a05bb054d1425ebc103

  • SHA512

    7bdba39b3150185bc66eac1ffe755826a3c2c2a8fe3503f64f79ac9be7dfa42eaee22446e603799824697317219ab1b9f58da5b4a0d64d370438846ea3fa1c5e

  • SSDEEP

    1536:hqskoqu3lbG6jejoigIH43Ywzi0Zb78ivombfexv0ujXyyed2atmulgS6p7l:Pt1FYH+zi0ZbYe1g0ujyzde7

Malware Config

Extracted

Family

redline

Botnet

pixelscloud2.0

C2

85.209.176.128:80

Signatures

  • RedLine payload 1 IoCs
  • Redline family
  • SectopRAT payload 1 IoCs
  • Sectoprat family
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 2620-226-0x00000000008D0000-0x00000000008EE000-memory.dmp
    .exe windows:4 windows x86


    Headers

    Sections