Overview

overview

10

Static

static

dridex

windows10-1703-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    46defec46679dd3b4854deff05ced12a53059645f312a88cd5937cd571e04851

  • Size

    436KB

  • Sample

    220906-n6e3ashffl

  • MD5

    b06cd5d6f70249f3b29e700ae9f673f7

  • SHA1

    21187061c165f59d826552271f45baa78b516dbd

  • SHA256

    46defec46679dd3b4854deff05ced12a53059645f312a88cd5937cd571e04851

  • SHA512

    79826d610016561b0b8e0fe0d174394b80b464a65af8d79f41ac3d5ebecd9dcfa4829e5dac06a76dfa3916d843a26fb44683c95ec7dbe4e59825a530b7a4174a

  • SSDEEP

    12288:1XhYvjUZn4ZFjF+19978H5lWtuEkNdLuUGQlWALBXEI:dSFjF+1L8HvWkNtGMuI

Score
10/10
redlinenam5infostealerspyware

Malware Config

Extracted

Family

redline

Botnet

nam5

C2

103.89.90.61:34589

Attributes
  • auth_value

    f23be8e9063fe5d0c6fc3ee8e7d565bd

Targets

    • Target

      46defec46679dd3b4854deff05ced12a53059645f312a88cd5937cd571e04851

    • Size

      436KB

    • MD5

      b06cd5d6f70249f3b29e700ae9f673f7

    • SHA1

      21187061c165f59d826552271f45baa78b516dbd

    • SHA256

      46defec46679dd3b4854deff05ced12a53059645f312a88cd5937cd571e04851

    • SHA512

      79826d610016561b0b8e0fe0d174394b80b464a65af8d79f41ac3d5ebecd9dcfa4829e5dac06a76dfa3916d843a26fb44683c95ec7dbe4e59825a530b7a4174a

    • SSDEEP

      12288:1XhYvjUZn4ZFjF+19978H5lWtuEkNdLuUGQlWALBXEI:dSFjF+1L8HvWkNtGMuI

    Score
    10/10
    redlinenam5infostealerspyware

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Suspicious use of SetThreadContext

    behavioral1

MITRE ATT&CK Enterprise v6

Tasks