Overview

overview

10

Static

static

dridex

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    9ee3f359c016cb3cf41ad7558cb18e92e224658b75e6b082b103ba293298a79f

  • Size

    17KB

  • Sample

    210926-m3efxsefdl

  • MD5

    9443fe1d92c02a1ae088f8683f8fbd21

  • SHA1

    f50d85a60e6bc2dbf81b44bb8dc7d6179d3a4ece

  • SHA256

    9ee3f359c016cb3cf41ad7558cb18e92e224658b75e6b082b103ba293298a79f

  • SHA512

    aa77d24581d56d1770669618e77fe8affd3c106c9bbfb588f1884124b6f79cbcc06cba677b31a800c1f7c794bccbe8abaf06f7648a24b594e4e0d60832bed51e

Score
10/10
redline13367discoveryinfostealerspywarestealer

Malware Config

Extracted

Family

redline

Botnet

13367

C2

94.250.250.77:32413

Targets

    • Target

      9ee3f359c016cb3cf41ad7558cb18e92e224658b75e6b082b103ba293298a79f

    • Size

      17KB

    • MD5

      9443fe1d92c02a1ae088f8683f8fbd21

    • SHA1

      f50d85a60e6bc2dbf81b44bb8dc7d6179d3a4ece

    • SHA256

      9ee3f359c016cb3cf41ad7558cb18e92e224658b75e6b082b103ba293298a79f

    • SHA512

      aa77d24581d56d1770669618e77fe8affd3c106c9bbfb588f1884124b6f79cbcc06cba677b31a800c1f7c794bccbe8abaf06f7648a24b594e4e0d60832bed51e

    Score
    10/10
    redline13367discoveryinfostealerspywarestealer

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine Payload

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

Lateral Movement

Collection

Data from Local System

2
T1005

Exfiltration

Command and Control

Impact

Tasks