Overview

overview

10

Static

static

dridex

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    006407341a7814a2f6ba46c9c948ff8659aa10340eec6d6b2e0399db71bc4b3c

  • Size

    369KB

  • Sample

    211016-ks4lysbgf5

  • MD5

    040df1e0d5a97f28ced3268dbfe91a9d

  • SHA1

    b60131c0a51b6a14bb11a0dac0772b03a71ef079

  • SHA256

    006407341a7814a2f6ba46c9c948ff8659aa10340eec6d6b2e0399db71bc4b3c

  • SHA512

    0db402fecc2986e413323238fbe707a923d1a7cd99ffcfdb998413ce6ecdc80973508bfc500fd9c927c3b1133c668cd128f85a3f80297f9cc0055e5b61e49c0c

Score
10/10
redlineudpdiscoveryinfostealerspywarestealer

Malware Config

Extracted

Family

redline

Botnet

UDP

C2

45.9.20.182:52236

Targets

    • Target

      006407341a7814a2f6ba46c9c948ff8659aa10340eec6d6b2e0399db71bc4b3c

    • Size

      369KB

    • MD5

      040df1e0d5a97f28ced3268dbfe91a9d

    • SHA1

      b60131c0a51b6a14bb11a0dac0772b03a71ef079

    • SHA256

      006407341a7814a2f6ba46c9c948ff8659aa10340eec6d6b2e0399db71bc4b3c

    • SHA512

      0db402fecc2986e413323238fbe707a923d1a7cd99ffcfdb998413ce6ecdc80973508bfc500fd9c927c3b1133c668cd128f85a3f80297f9cc0055e5b61e49c0c

    Score
    10/10
    redlineudpdiscoveryinfostealerspywarestealer

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine Payload

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

1
T1012

Lateral Movement

Collection

Data from Local System

2
T1005

Exfiltration

Command and Control

Impact

Tasks