General
-
Target
4476-163-0x00000000012C0000-0x0000000001D8A000-memory.dmp
-
Size
2.9MB
-
MD5
95fec305efaa535729ee9bf5357ad9dd
-
SHA1
c6b518888f5de8d2c2c6a58f5d137ed6206c510d
-
SHA256
7fd810d7267aa8a1cc764a9f395081860de235213a309bee0bf1b188ec979c62
-
SHA512
7e0658692a84cd55ed71f663658982f1940e6e4f4520542ecd889aee05aa100f2a18f56d6eeaaefe164f285b1017b201ca0a77f3e746207c1543dc09d0d85f3f
-
SSDEEP
49152:NyOkLT5cT+ctW6mTONq5u+lfrWmVS0IoNw1Wvhbxzb7re7SGBq:NyrX5cT+0nmmIlzWmVS0Isw1Wvdxzb7L
Score
10/10
Malware Config
Extracted
Family
redline
Botnet
55000
C2
38.47.221.193:34368
Signatures
-
Redline family
-
Themida packer 1 IoCs
Detects Themida, an advanced Windows software protection system.
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
4476-163-0x00000000012C0000-0x0000000001D8A000-memory.dmp
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
Imports
Sections