redline | 2632-39-0x0000000000090000-0x00000000000E2000-memory[.]dmp

General

Target
2632-39-0x0000000000090000-0x00000000000E2000-memory.dmp
Size 328KB
Sample240512-ea5hmseh6t
SHA256 ea12131d2ee6e17da9e86967fd0a864c6f4fd90adce6d003313c690718cf2026
MD5 114f7ca0abb0f1ea97251342c305412d
SHA1 e786a8653f5c260371742e6014796ec63fdae99d
SHA512 c6cc2d8ecbe4cbb959385ba77e8fc058568119b7a380fd721eb80770a136c4cb808389f99b83ff2a6098c5eb336e8961a57bc829607adf65bc41ab2dbf74e775
SSDEEP 3072:Gq6EgY6iArUj7rY1wPlLBvZuDxCf01ITAWtAvKaEcZqf7D34FeqiOLibBO3:dqY6iWwPXRuDMCITAyAlEcZqf7DIPL
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

1 redline

Malware Config

Extracted

Family

redline

Botnet

1

C2

178.159.39.40:19667

Signatures

RedLine payload 1 IoCs

resource	yara_rule
sample	family_redline

Redline family
redline

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2632-39-0x0000000000090000-0x00000000000E2000-memory.dmp

File Explorer

2632-39-0x0000000000090000-0x00000000000E2000-memory.dmp

.exe 328KB

2632-39-0x0000000000090000-0x00000000000E2000-memory.dmp

SHA256 ea12131d2ee6e17da9e86967fd0a864c6f4fd90adce6d003313c690718cf2026
MD5 114f7ca0abb0f1ea97251342c305412d
SHA1 e786a8653f5c260371742e6014796ec63fdae99d
SHA512 c6cc2d8ecbe4cbb959385ba77e8fc058568119b7a380fd721eb80770a136c4cb808389f99b83ff2a6098c5eb336e8961a57bc829607adf65bc41ab2dbf74e775
SSDEEP 3072:Gq6EgY6iArUj7rY1wPlLBvZuDxCf01ITAWtAvKaEcZqf7D34FeqiOLibBO3:dqY6iWwPXRuDMCITAyAlEcZqf7DIPL
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

RedLine payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

178606

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Sharing