Overview

overview

10

Static

static

dridex

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    9d14fb440051c68dbca6f968127d1ffdd43bf3a7ca43da7876dabd809be40791

  • Size

    705KB

  • Sample

    211024-1xndjafcf9

  • MD5

    378c0ffbcfa46bdd32eb1d62be368bab

  • SHA1

    6253b11aeb700a8c9feee93e660e74dc71f4bf2f

  • SHA256

    9d14fb440051c68dbca6f968127d1ffdd43bf3a7ca43da7876dabd809be40791

  • SHA512

    c6351dff1abb653016e210fa6a562d7ebe8cfbfa6a4da58048c312f3cf2970221ff811abb89b3d265cbc1bef88d02388b3c596c3b9f6e69516ef0d2538b5d2c4

Score
10/10
redlinediscoveryinfostealerspywarestealer

Malware Config

Targets

    • Target

      9d14fb440051c68dbca6f968127d1ffdd43bf3a7ca43da7876dabd809be40791

    • Size

      705KB

    • MD5

      378c0ffbcfa46bdd32eb1d62be368bab

    • SHA1

      6253b11aeb700a8c9feee93e660e74dc71f4bf2f

    • SHA256

      9d14fb440051c68dbca6f968127d1ffdd43bf3a7ca43da7876dabd809be40791

    • SHA512

      c6351dff1abb653016e210fa6a562d7ebe8cfbfa6a4da58048c312f3cf2970221ff811abb89b3d265cbc1bef88d02388b3c596c3b9f6e69516ef0d2538b5d2c4

    Score
    10/10
    redlinediscoveryinfostealerspywarestealer

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine Payload

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Legitimate hosting services abused for malware hosting/C2

    behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Data from Local System

2
T1005

Exfiltration

Command and Control

Web Service

1
T1102

Impact

Tasks