Overview

overview

10

Static

static

dridex

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d7958b926af70db5f634bb3314541a987cc445f3fb33cfb1141929e5fd725198

  • Size

    249KB

  • Sample

    210926-n6kmsaegh2

  • MD5

    ee258761c2e66a61babef3c7408a21ee

  • SHA1

    1edf45a91faa1ec1912e8134edec8f607381ba84

  • SHA256

    d7958b926af70db5f634bb3314541a987cc445f3fb33cfb1141929e5fd725198

  • SHA512

    ed628742598ae5ebb89444fafd5be8dac9d5672d8c1be4c2e96a9c647fd51ec831b88c215fdaa3990b9a0e8a61e7cc3b922a32d61622c1520979b11c67c94f08

Score
10/10
redlineudpdiscoveryinfostealerspywarestealer

Malware Config

Extracted

Family

redline

Botnet

UDP

C2

45.9.20.20:13441

Targets

    • Target

      d7958b926af70db5f634bb3314541a987cc445f3fb33cfb1141929e5fd725198

    • Size

      249KB

    • MD5

      ee258761c2e66a61babef3c7408a21ee

    • SHA1

      1edf45a91faa1ec1912e8134edec8f607381ba84

    • SHA256

      d7958b926af70db5f634bb3314541a987cc445f3fb33cfb1141929e5fd725198

    • SHA512

      ed628742598ae5ebb89444fafd5be8dac9d5672d8c1be4c2e96a9c647fd51ec831b88c215fdaa3990b9a0e8a61e7cc3b922a32d61622c1520979b11c67c94f08

    Score
    10/10
    redlineudpdiscoveryinfostealerspywarestealer

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine Payload

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

1
T1012

Lateral Movement

Collection

Data from Local System

2
T1005

Exfiltration

Command and Control

Impact

Tasks