Overview

overview

10

Static

static

dridex

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2d10e11cf76770ce4a4941b7abd930008b79e18306478031df821ef9ae9d5b2e

  • Size

    145KB

  • Sample

    210926-hfvgeaeec4

  • MD5

    d37e1e3dd70bc0035c13ded75f27c930

  • SHA1

    0e7f454578fb459f2afd7af721e844bf036597c3

  • SHA256

    2d10e11cf76770ce4a4941b7abd930008b79e18306478031df821ef9ae9d5b2e

  • SHA512

    381c9c9775bfbf9b82e034effe7d8b8d321d179d1eb34962d444e0fc1096df16d4301a91175bdee75bc8ed371636330634b9e56402234dccba5322055684f03e

Score
10/10
redlinesmokeloaderagilenetbackdoorinfostealerspywarestealertrojan

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://naghenrietti1.top/

http://kimballiett2.top/

http://xadriettany3.top/

http://jebeccallis4.top/

http://nityanneron5.top/

http://umayaniela6.top/

http://lynettaram7.top/

http://sadineyalas8.top/

http://geenaldencia9.top/

http://aradysiusep10.top/
rc4.i32
rc4.i32

Extracted

Family

redline

C2

91.236.120.204:20853

Targets

    • Target

      2d10e11cf76770ce4a4941b7abd930008b79e18306478031df821ef9ae9d5b2e

    • Size

      145KB

    • MD5

      d37e1e3dd70bc0035c13ded75f27c930

    • SHA1

      0e7f454578fb459f2afd7af721e844bf036597c3

    • SHA256

      2d10e11cf76770ce4a4941b7abd930008b79e18306478031df821ef9ae9d5b2e

    • SHA512

      381c9c9775bfbf9b82e034effe7d8b8d321d179d1eb34962d444e0fc1096df16d4301a91175bdee75bc8ed371636330634b9e56402234dccba5322055684f03e

    Score
    10/10
    redlinesmokeloaderagilenetbackdoorinfostealerspywarestealertrojan

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine Payload

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

      trojanbackdoorsmokeloader

    • Executes dropped EXE

    • Deletes itself

    • Obfuscated with Agile.Net obfuscator

      Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

      agilenet

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Suspicious use of SetThreadContext

    behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

1
T1082

Lateral Movement

Collection

Data from Local System

2
T1005

Exfiltration

Command and Control

Impact

Tasks