Overview

overview

10

Static

static

dridex

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    474e3fc373334ef2e2850d2ac5324dbf1f016b776eefe6a1d3d0b9c9c1cb6982

  • Size

    364KB

  • Sample

    211019-skqn5agag8

  • MD5

    8293d32de78adcdcbfa52ff212dfba13

  • SHA1

    2f6342bdf7139dfbf10b32c9bac678daa90145f2

  • SHA256

    474e3fc373334ef2e2850d2ac5324dbf1f016b776eefe6a1d3d0b9c9c1cb6982

  • SHA512

    a59b194405cb476773cece3dfefb71c9797031db17f1988a15e9567b8b115cedd7e4cda0c9758fd5982d833f2f5747ab8aa6b99dbeadf2cfce7c7202ac032379

Score
10/10
redlineutsdiscoveryinfostealerspywarestealer

Malware Config

Extracted

Family

redline

Botnet

UTS

C2

45.9.20.182:52236

Targets

    • Target

      474e3fc373334ef2e2850d2ac5324dbf1f016b776eefe6a1d3d0b9c9c1cb6982

    • Size

      364KB

    • MD5

      8293d32de78adcdcbfa52ff212dfba13

    • SHA1

      2f6342bdf7139dfbf10b32c9bac678daa90145f2

    • SHA256

      474e3fc373334ef2e2850d2ac5324dbf1f016b776eefe6a1d3d0b9c9c1cb6982

    • SHA512

      a59b194405cb476773cece3dfefb71c9797031db17f1988a15e9567b8b115cedd7e4cda0c9758fd5982d833f2f5747ab8aa6b99dbeadf2cfce7c7202ac032379

    Score
    10/10
    redlineutsdiscoveryinfostealerspywarestealer

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine Payload

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

1
T1012

Lateral Movement

Collection

Data from Local System

2
T1005

Exfiltration

Command and Control

Impact

Tasks