redline | 2824-7-0x0000000000400000-0x000000000043C000-memory[.]dmp

General

Target
2824-7-0x0000000000400000-0x000000000043C000-memory.dmp
Size 240KB
Sample231114-ls7t2sbc88
SHA256 7f5308de37eef4166c9a56d5ad86378f7d720f0c75f6fef156114a617c2b62f6
MD5 d8a4ef896953deb9703569efbd3bbb2d
SHA1 73c47fffe658476b1558c3d991de25adfb073541
SHA512 4e88eb46f659141ab3b2b74e8ca53c4769f64f03ad1f58b474a2174276f17b94e248b2b0b7126c0f62c7493a3f84b90bee0d34fbf1bd935fda432095d06f66c8
SSDEEP 3072:erK0HJ7HNgcCmDCrtaR3EQpiCIL0RSdOo1Sqw5laFKSD:erK0J7HNgcC3rtaR3400Uo1SnLaY
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

taiga redline

Malware Config

Extracted

Family

redline

Botnet

taiga

C2

5.42.92.51:19057

Signatures

RedLine payload 1 IoCs

resource	yara_rule
sample	family_redline

Redline family
redline

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2824-7-0x0000000000400000-0x000000000043C000-memory.dmp

File Explorer

2824-7-0x0000000000400000-0x000000000043C000-memory.dmp

.exe 240KB

2824-7-0x0000000000400000-0x000000000043C000-memory.dmp

SHA256 7f5308de37eef4166c9a56d5ad86378f7d720f0c75f6fef156114a617c2b62f6
MD5 d8a4ef896953deb9703569efbd3bbb2d
SHA1 73c47fffe658476b1558c3d991de25adfb073541
SHA512 4e88eb46f659141ab3b2b74e8ca53c4769f64f03ad1f58b474a2174276f17b94e248b2b0b7126c0f62c7493a3f84b90bee0d34fbf1bd935fda432095d06f66c8
SSDEEP 3072:erK0HJ7HNgcCmDCrtaR3EQpiCIL0RSdOo1Sqw5laFKSD:erK0J7HNgcC3rtaR3400Uo1SnLaY
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86

RedLine payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

1955888367

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Sharing