Overview

overview

10

Static

static

dridex

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ce245c1f629023dd99cd4b518a1d9264c507bb7f1afa7a749862de43123cf21b

  • Size

    297KB

  • Sample

    211126-vkd2fagha4

  • MD5

    96f1591e657779b1a07f989cb82d5bf5

  • SHA1

    d68bbffb283613c033d78b2e1aa6ddffaa3b9578

  • SHA256

    ce245c1f629023dd99cd4b518a1d9264c507bb7f1afa7a749862de43123cf21b

  • SHA512

    8e6327139db8887d67adb0ea6fa3df894e644e6e5ea4cb00a7df46a3ab1a84166cc70d9744775c79bf7c21c89fd4f336536aa691d26aa5574a27d65d1e6faa2e

Score
10/10
redlineudptestdiscoveryinfostealerspywarestealer

Malware Config

Extracted

Family

redline

Botnet

udptest

C2

193.56.146.64:65441

Targets

    • Target

      ce245c1f629023dd99cd4b518a1d9264c507bb7f1afa7a749862de43123cf21b

    • Size

      297KB

    • MD5

      96f1591e657779b1a07f989cb82d5bf5

    • SHA1

      d68bbffb283613c033d78b2e1aa6ddffaa3b9578

    • SHA256

      ce245c1f629023dd99cd4b518a1d9264c507bb7f1afa7a749862de43123cf21b

    • SHA512

      8e6327139db8887d67adb0ea6fa3df894e644e6e5ea4cb00a7df46a3ab1a84166cc70d9744775c79bf7c21c89fd4f336536aa691d26aa5574a27d65d1e6faa2e

    Score
    10/10
    redlineudptestdiscoveryinfostealerspywarestealer

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine Payload

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

1
T1012

Lateral Movement

Collection

Data from Local System

2
T1005

Exfiltration

Command and Control

Impact

Tasks