Overview

overview

10

Static

static

8

dridex

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0c23eff9a277566a9b6422f89e942cb6a8e99a2e173338243114d7658ccda921

  • Size

    5.9MB

  • Sample

    211218-j67ebsefc7

  • MD5

    8b3d932651fff1433dc7e5e4754acda4

  • SHA1

    f540f07f7ea8d5e49486c50af7eb798d5ddf9afe

  • SHA256

    0c23eff9a277566a9b6422f89e942cb6a8e99a2e173338243114d7658ccda921

  • SHA512

    b2eb5b78197e7cb708f46912e1470e4dd9fdc61afc3e1007025507e7b184cf9987f045391e8ebb78676154a0c6312560a813964addc43727afceef43cdbd228b

Score
10/10
redline444infostealerspywarevmprotect

Malware Config

Extracted

Family

redline

Botnet

444

C2

31.131.254.105:1498

Targets

    • Target

      0c23eff9a277566a9b6422f89e942cb6a8e99a2e173338243114d7658ccda921

    • Size

      5.9MB

    • MD5

      8b3d932651fff1433dc7e5e4754acda4

    • SHA1

      f540f07f7ea8d5e49486c50af7eb798d5ddf9afe

    • SHA256

      0c23eff9a277566a9b6422f89e942cb6a8e99a2e173338243114d7658ccda921

    • SHA512

      b2eb5b78197e7cb708f46912e1470e4dd9fdc61afc3e1007025507e7b184cf9987f045391e8ebb78676154a0c6312560a813964addc43727afceef43cdbd228b

    Score
    10/10
    redline444infostealerspywarevmprotect

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine Payload

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

      vmprotect

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Legitimate hosting services abused for malware hosting/C2

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Web Service

1
T1102

Impact

Tasks