Overview

overview

10

Static

static

dridex

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f7cfb6029de72b73aa2c026af9e766e2823637c8c1ec41cbb916dee0bfe0944e

  • Size

    658KB

  • Sample

    211019-mtxk5sgfal

  • MD5

    8dc2770eda3f0e20e6d49f5b266f45af

  • SHA1

    1b56d40c040d1643e48be35e52413a3141c84a29

  • SHA256

    f7cfb6029de72b73aa2c026af9e766e2823637c8c1ec41cbb916dee0bfe0944e

  • SHA512

    8a2eb80849a648793bea7dacd75d33edaea685ee27ad962645f1e2d522c06e9c7ed0b14f5a7e3d6340330fe3f435b85cc2f6f20ce208addc160a00caf1495158

Score
10/10
redline19.10discoveryinfostealerspywarestealersuricata

Malware Config

Extracted

Family

redline

Botnet

19.10

C2

185.215.113.17:9054

Targets

    • Target

      f7cfb6029de72b73aa2c026af9e766e2823637c8c1ec41cbb916dee0bfe0944e

    • Size

      658KB

    • MD5

      8dc2770eda3f0e20e6d49f5b266f45af

    • SHA1

      1b56d40c040d1643e48be35e52413a3141c84a29

    • SHA256

      f7cfb6029de72b73aa2c026af9e766e2823637c8c1ec41cbb916dee0bfe0944e

    • SHA512

      8a2eb80849a648793bea7dacd75d33edaea685ee27ad962645f1e2d522c06e9c7ed0b14f5a7e3d6340330fe3f435b85cc2f6f20ce208addc160a00caf1495158

    Score
    10/10
    redline19.10discoveryinfostealerspywarestealersuricata

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine Payload

    • suricata: ET MALWARE AutoHotkey Downloader Checkin via IPLogger

      suricata: ET MALWARE AutoHotkey Downloader Checkin via IPLogger

      suricata

    • suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

      suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

      suricata

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Legitimate hosting services abused for malware hosting/C2

    behavioral1

MITRE ATT&CK Enterprise v6

Tasks