Overview

overview

10

Static

static

dridex

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2d090a2cf40c2b82288160ecce78416c10343100b21434a3bfc7b6167747682a

  • Size

    296KB

  • Sample

    211126-2v8gcsafa2

  • MD5

    235b56fb26d7ef2f0bfce5b521a0b99c

  • SHA1

    d5deb3e56423a6865c543636dad0e4ef756eaa15

  • SHA256

    2d090a2cf40c2b82288160ecce78416c10343100b21434a3bfc7b6167747682a

  • SHA512

    1eb2a2968f7052311cf67c35d863847e5fda213c6ab827e3aa76ff23dcf8cc31c609feae45a0a446f064182bc44938f4407681a77c9a40a67ba87c4d11b11609

Score
10/10
redlinepubdatediscoveryinfostealerspywarestealer

Malware Config

Extracted

Family

redline

Botnet

Pubdate

C2

193.56.146.64:65441

Targets

    • Target

      2d090a2cf40c2b82288160ecce78416c10343100b21434a3bfc7b6167747682a

    • Size

      296KB

    • MD5

      235b56fb26d7ef2f0bfce5b521a0b99c

    • SHA1

      d5deb3e56423a6865c543636dad0e4ef756eaa15

    • SHA256

      2d090a2cf40c2b82288160ecce78416c10343100b21434a3bfc7b6167747682a

    • SHA512

      1eb2a2968f7052311cf67c35d863847e5fda213c6ab827e3aa76ff23dcf8cc31c609feae45a0a446f064182bc44938f4407681a77c9a40a67ba87c4d11b11609

    Score
    10/10
    redlinepubdatediscoveryinfostealerspywarestealer

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine Payload

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

1
T1012

Lateral Movement

Collection

Data from Local System

2
T1005

Exfiltration

Command and Control

Impact

Tasks