Overview

overview

10

Static

static

dridex

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    c23b096fdd5379aeaee9a28e4561143596fe1c7d32555f915a69725c99fba470

  • Size

    1.4MB

  • Sample

    211119-kl956ahgfm

  • MD5

    b4ebbc92b9c6aea78e9b797e9365d61b

  • SHA1

    3046ac629e1b298d7af16d0a52d529e165723ae6

  • SHA256

    c23b096fdd5379aeaee9a28e4561143596fe1c7d32555f915a69725c99fba470

  • SHA512

    58bb1d4bf282bbe18c51b13bb7a4a1a23b75c9fa75541f2a202b4c02a4b64f7ce48d5d08f0f07dba9b4a8e3052565bbadf27d60d4a528dfd6971457fcae79a24

Score
10/10
redline@zhilsholievasioninfostealerspywaresuricatatrojan

Malware Config

Extracted

Family

redline

Botnet

@zhilsholi

C2

nariviqusir.xyz:81

Targets

    • Target

      c23b096fdd5379aeaee9a28e4561143596fe1c7d32555f915a69725c99fba470

    • Size

      1.4MB

    • MD5

      b4ebbc92b9c6aea78e9b797e9365d61b

    • SHA1

      3046ac629e1b298d7af16d0a52d529e165723ae6

    • SHA256

      c23b096fdd5379aeaee9a28e4561143596fe1c7d32555f915a69725c99fba470

    • SHA512

      58bb1d4bf282bbe18c51b13bb7a4a1a23b75c9fa75541f2a202b4c02a4b64f7ce48d5d08f0f07dba9b4a8e3052565bbadf27d60d4a528dfd6971457fcae79a24

    Score
    10/10
    redline@zhilsholievasioninfostealerspywaresuricatatrojan

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine Payload

    • Suspicious use of NtCreateProcessExOtherParentProcess

    • suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

      suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

      suricata

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Checks whether UAC is enabled

      evasiontrojan

    • Suspicious use of SetThreadContext

    behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Virtualization/Sandbox Evasion

1
T1497

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

2
T1012

Virtualization/Sandbox Evasion

1
T1497

System Information Discovery

3
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks