Overview

overview

10

Static

static

dridex

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ae25e600db8576a23d9fb0c8a6b7254a253aa09a0190ecc8e72d6444761d8478

  • Size

    396KB

  • Sample

    211109-qgg7gacdcm

  • MD5

    ebd93ffc2ea603ea8c653ca2c7d7c296

  • SHA1

    be43eecf9ed2b92edd94e5232d71d7ad9fe398a1

  • SHA256

    ae25e600db8576a23d9fb0c8a6b7254a253aa09a0190ecc8e72d6444761d8478

  • SHA512

    e9fc09664c1a5807b227c3eca81839d4d84aa53e91016d36d086fda89fe88f9dc65317bde7039dd21760ad16cf70f6bdd67fbbd15982c3a8fe31935499250baf

Score
10/10
redline1132044836discoveryinfostealerspywarestealer

Malware Config

Extracted

Family

redline

Botnet

1132044836

C2

185.183.32.184:80

Targets

    • Target

      ae25e600db8576a23d9fb0c8a6b7254a253aa09a0190ecc8e72d6444761d8478

    • Size

      396KB

    • MD5

      ebd93ffc2ea603ea8c653ca2c7d7c296

    • SHA1

      be43eecf9ed2b92edd94e5232d71d7ad9fe398a1

    • SHA256

      ae25e600db8576a23d9fb0c8a6b7254a253aa09a0190ecc8e72d6444761d8478

    • SHA512

      e9fc09664c1a5807b227c3eca81839d4d84aa53e91016d36d086fda89fe88f9dc65317bde7039dd21760ad16cf70f6bdd67fbbd15982c3a8fe31935499250baf

    Score
    10/10
    redline1132044836discoveryinfostealerspywarestealer

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine Payload

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

1
T1012

Lateral Movement

Collection

Data from Local System

2
T1005

Exfiltration

Command and Control

Impact

Tasks