General

  • Target

    5732-863-0x0000000001100000-0x0000000001152000-memory.dmp

  • Size

    328KB

  • MD5

    96aba7289b928eb487d2c52f353a4c53

  • SHA1

    f6ba1f3db43db3d257591e17d06a11a0f76a3620

  • SHA256

    fddf38b5530ca338a4a7fbfb3197ef55e36d2af4abca1c8a35cc4dac57c87e47

  • SHA512

    db38118aa832d028fc37e9694949c5ccefd9d3e3a803c5063b0ebf180be1528f34ee1f298f07262e48311365c6cff0540ff60419a7fa05ac03fefef809523495

  • SSDEEP

    3072:C2GLL3Y8QRrvRLsbMSNXmQogXIdilX+nupxQRmAgkVMRqT6Dv/YVeqiOL2bBOU:HobM+eilRxQEAXVMRqT6D4/L

Score
10/10

Malware Config

Extracted

Family

redline

Botnet

Legaa

C2

185.172.128.33:38294

Signatures

  • RedLine payload 1 IoCs
  • Redline family
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 5732-863-0x0000000001100000-0x0000000001152000-memory.dmp
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections