Overview

overview

10

Static

static

dridex

windows10-1703-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0049054e585f7114573046856dfe81d666c9556d9a16aa6239d47304ead89a4e

  • Size

    347KB

  • Sample

    220812-brrfkaehcm

  • MD5

    148a128744d28d91f9e9f2ac3e0d3deb

  • SHA1

    899e1a7ef99262d042c27106f0e6df4645bd09ab

  • SHA256

    0049054e585f7114573046856dfe81d666c9556d9a16aa6239d47304ead89a4e

  • SHA512

    16983266f891302ca35ed31264a39960255cdaf1dbbb5fd4d808ca7d4fa92c4cb9beb10ddaaadfec2e9544123675fb6ba13a3a3f0f4106d01c365b22dd93abc2

Score
10/10
redlineruzkidiscoveryinfostealerspywarestealer

Malware Config

Extracted

Family

redline

Botnet

ruzki

C2

193.106.191.165:39482

Attributes
  • auth_value

    71a0558c0eea274a5bd617ea85786884

Targets

    • Target

      0049054e585f7114573046856dfe81d666c9556d9a16aa6239d47304ead89a4e

    • Size

      347KB

    • MD5

      148a128744d28d91f9e9f2ac3e0d3deb

    • SHA1

      899e1a7ef99262d042c27106f0e6df4645bd09ab

    • SHA256

      0049054e585f7114573046856dfe81d666c9556d9a16aa6239d47304ead89a4e

    • SHA512

      16983266f891302ca35ed31264a39960255cdaf1dbbb5fd4d808ca7d4fa92c4cb9beb10ddaaadfec2e9544123675fb6ba13a3a3f0f4106d01c365b22dd93abc2

    Score
    10/10
    redlineruzkidiscoveryinfostealerspywarestealer

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

1
T1012

Lateral Movement

Collection

Data from Local System

2
T1005

Exfiltration

Command and Control

Impact

Tasks