Overview

overview

10

Static

static

dridex

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    907876df0427090d4661a0b1dbc1e39c8cef859f7b6872cf2ed1f2fdc1c250f4

  • Size

    727KB

  • Sample

    210821-xtg45jtx6s

  • MD5

    33e12da8c235ff1459e0f0a8fabee0ec

  • SHA1

    f1d1afc7d92ce245ec16a5fe6046817b65abfcf3

  • SHA256

    907876df0427090d4661a0b1dbc1e39c8cef859f7b6872cf2ed1f2fdc1c250f4

  • SHA512

    cd592c8deca609e7556ecb866d835b655a37ba5593f8ffad48933e3644fe6c53fa2073ad6841e69d46fd7136fbc495f59e33d943cc234507f0d19713eda3fb27

Score
10/10
redlineruzdiscoveryevasioninfostealerspywarestealer

Malware Config

Extracted

Family

redline

Botnet

RUZ

C2

oltorarrar.xyz:80

Targets

    • Target

      907876df0427090d4661a0b1dbc1e39c8cef859f7b6872cf2ed1f2fdc1c250f4

    • Size

      727KB

    • MD5

      33e12da8c235ff1459e0f0a8fabee0ec

    • SHA1

      f1d1afc7d92ce245ec16a5fe6046817b65abfcf3

    • SHA256

      907876df0427090d4661a0b1dbc1e39c8cef859f7b6872cf2ed1f2fdc1c250f4

    • SHA512

      cd592c8deca609e7556ecb866d835b655a37ba5593f8ffad48933e3644fe6c53fa2073ad6841e69d46fd7136fbc495f59e33d943cc234507f0d19713eda3fb27

    Score
    10/10
    redlineruzdiscoveryevasioninfostealerspywarestealer

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine Payload

    • Executes dropped EXE

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

      evasion

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Suspicious use of SetThreadContext

    behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Hidden Files and Directories

2
T1158

Privilege Escalation

Defense Evasion

Hidden Files and Directories

2
T1158

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

Lateral Movement

Collection

Data from Local System

2
T1005

Exfiltration

Command and Control

Impact

Tasks