redline | 3020-131-0x0000000000480000-0x000000000050C000-memory[.]dmp | Triage

Sharing

Copy URL Twitter E-mail

General

Target

3020-131-0x0000000000480000-0x000000000050C000-memory.dmp
Size

560KB
MD5

f1b6f47db31f0b0f2bd724aa2d057498
SHA1

8c0309f136f484cbcea643c9e8aa1e4c5daa25c8
SHA256

8d42c82d6a0f2e1e061b0d09e9d05617bee3cd1331bee11c0884f6e34ac0e690
SHA512

015795431f1f73088ba26e4873aacadfdf4c724c8682d2a904ab04d60002e89eb00fe5520095103588efefa32f0890910be9c2d71365591decfb7e8d2788ad94
SSDEEP

12288:GO5FfuOX6OnTPCAD50XddOSpoNOOX4CfVD3Z1e24Yv6QcTXH2:GO5QOX6e/NsbQD3ZE2

Score

10^/10

lamp redline

Malware Config

Extracted

Family

redline

Botnet

lamp

C2

77.91.68.56:19071

Attributes

auth_value
ee1df63bcdbe3de70f52810d94eaff7d

Signatures

RedLine payload 1 IoCs

resource	yara_rule
sample	family_redline

Redline family
redline

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3020-131-0x0000000000480000-0x000000000050C000-memory.dmp

Files

3020-131-0x0000000000480000-0x000000000050C000-memory.dmp
.exe windows:4 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: - Virtual size: 131KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.E$D
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.F7B
Size: 354KB - Virtual size: 354KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 39KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ