Overview

overview

10

Static

static

dridex

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    888630141c7a5a8a7e4d27aa6f4e916598cd412ed59c34d3fce4449ec985b1fa

  • Size

    416KB

  • Sample

    220521-j9mjbsbcc2

  • MD5

    d291f980b2a72f3f76e0d84e30339a50

  • SHA1

    2cc395a482286f3c1ab9a25b400532821cdfd3bd

  • SHA256

    888630141c7a5a8a7e4d27aa6f4e916598cd412ed59c34d3fce4449ec985b1fa

  • SHA512

    fd6ae5aa32b4e2a3f5883ed8a47b3b595ad821995f9b29e59be5114d62f7ad63c174574cec807f80af085e015009dfe8ce2477ed648e9466650ca72bcc8df1fa

Score
10/10
redlineruzkidiscoveryinfostealerspywarestealer

Malware Config

Extracted

Family

redline

Botnet

Ruzki

C2

193.233.48.58:38989

Attributes
  • auth_value

    80c38cc7772c328c028b0e4f42a3fac6

Targets

    • Target

      888630141c7a5a8a7e4d27aa6f4e916598cd412ed59c34d3fce4449ec985b1fa

    • Size

      416KB

    • MD5

      d291f980b2a72f3f76e0d84e30339a50

    • SHA1

      2cc395a482286f3c1ab9a25b400532821cdfd3bd

    • SHA256

      888630141c7a5a8a7e4d27aa6f4e916598cd412ed59c34d3fce4449ec985b1fa

    • SHA512

      fd6ae5aa32b4e2a3f5883ed8a47b3b595ad821995f9b29e59be5114d62f7ad63c174574cec807f80af085e015009dfe8ce2477ed648e9466650ca72bcc8df1fa

    Score
    10/10
    redlineruzkidiscoveryinfostealerspywarestealer

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine Payload

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1

MITRE ATT&CK Enterprise v6

Tasks