Overview

overview

10

Static

static

dridex

windows10-1703-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    92e54c56f2b1398fa9473b0327da8784ab19bae72e1959b26116dc33e02cd1a6

  • Size

    417KB

  • Sample

    220806-p3xzdaeghn

  • MD5

    fcf3d2282bb541c490f74cfd648357a8

  • SHA1

    bd2f7f440b89c942f8e5f1364bf0cd3ac7dcd5b8

  • SHA256

    92e54c56f2b1398fa9473b0327da8784ab19bae72e1959b26116dc33e02cd1a6

  • SHA512

    580c548d11f419ebf2452b0604cbe8558dfc1b7bd8d6bf81dfd542cf0f0a5402f6bc8f48321f4d3566202b15b7996aac7e98cfe76123baa13576acebe933811f

Score
10/10
redlineruzkidiscoveryinfostealerspywarestealer

Malware Config

Extracted

Family

redline

Botnet

ruzki

C2

193.106.191.165:39482

Attributes
  • auth_value

    71a0558c0eea274a5bd617ea85786884

Targets

    • Target

      92e54c56f2b1398fa9473b0327da8784ab19bae72e1959b26116dc33e02cd1a6

    • Size

      417KB

    • MD5

      fcf3d2282bb541c490f74cfd648357a8

    • SHA1

      bd2f7f440b89c942f8e5f1364bf0cd3ac7dcd5b8

    • SHA256

      92e54c56f2b1398fa9473b0327da8784ab19bae72e1959b26116dc33e02cd1a6

    • SHA512

      580c548d11f419ebf2452b0604cbe8558dfc1b7bd8d6bf81dfd542cf0f0a5402f6bc8f48321f4d3566202b15b7996aac7e98cfe76123baa13576acebe933811f

    Score
    10/10
    redlineruzkidiscoveryinfostealerspywarestealer

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

1
T1012

Lateral Movement

Collection

Data from Local System

2
T1005

Exfiltration

Command and Control

Impact

Tasks