Overview

overview

10

Static

static

10

1252-4286-...ry.exe

windows7-x64

1

1252-4286-...ry.exe

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1252-4286-0x0000000000B80000-0x0000000000BB2000-memory.dmp

  • Size

    200KB

  • MD5

    dcda2e7975cbc85181cd1a038c86d39f

  • SHA1

    c41b8baff302eaadeff85e36cabbdeda85e49cfa

  • SHA256

    a44f510024e8a4d25a089d60edf9df708a326cce108159f851dc47424b420bca

  • SHA512

    fbc643cc7d7ebf1c352a459c6d08732bf1c1169d59dce0ac5444abb2fbdb5d54321cd489b837f0e17538477b5575c62b80da924228720a1ecbaaf3e1d2ebd998

  • SSDEEP

    3072:5xqZWFFa7E6T8nzEmcJXetr9dh8jxNn2pU9f2MKTV/wi4lr55R9TxlnsPsUw0jOm:rqZcnzEpJedh

Score
10/10
nahuiredline

Malware Config

Extracted

Family

redline

Botnet

nahui

C2

176.113.115.145:4125

Attributes
  • auth_value

    b9ed10946d21e28d58d0c72c535cde6f

Signatures

  • RedLine payload 1 IoCs
  • Redline family
    redline
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 1252-4286-0x0000000000B80000-0x0000000000BB2000-memory.dmp
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections