Overview

overview

10

Static

static

dridex

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0f8b56af0b1be1247a5bf989a92eca657855d96e4b3b9eac1a109cbe8bfbd40a

  • Size

    130KB

  • Sample

    220926-w2tznacgdk

  • MD5

    2ae08b2b339f8593d743991cce0c747c

  • SHA1

    d99acc1fc5702475f27c729be631fb0c4d2f1625

  • SHA256

    0f8b56af0b1be1247a5bf989a92eca657855d96e4b3b9eac1a109cbe8bfbd40a

  • SHA512

    bc6c43377168db0d06a682e4f99187bd06f16b1da058e37090ae902ed8dd87fa68578fa17cf3cf9b223b91c5c648e8b3e492030f026a6253aa28efaaf16633f2

  • SSDEEP

    3072:YKiT13Tc5d/Lb4dc+oytXrlvfYa1f+Mxn5B:E1E/vD+Z2aJ+Mx

Score
10/10
redlinesmokeloaderinstall1partlogsdiller cloud (tg: @mr_golds)backdoordiscoveryinfostealerspywarestealertrojan

Malware Config

Extracted

Family

redline

Botnet

LogsDiller Cloud (TG: @mr_golds)

C2

77.73.134.27:7161

Attributes
  • auth_value

    4b2de03af6b6ac513ac597c2e6c1ad51

Extracted

Family

redline

Botnet

install1part

C2

185.224.133.182:16382

Attributes
  • auth_value

    01759eb8d6120155c19b779c527fb1e2

Targets

    • Target

      0f8b56af0b1be1247a5bf989a92eca657855d96e4b3b9eac1a109cbe8bfbd40a

    • Size

      130KB

    • MD5

      2ae08b2b339f8593d743991cce0c747c

    • SHA1

      d99acc1fc5702475f27c729be631fb0c4d2f1625

    • SHA256

      0f8b56af0b1be1247a5bf989a92eca657855d96e4b3b9eac1a109cbe8bfbd40a

    • SHA512

      bc6c43377168db0d06a682e4f99187bd06f16b1da058e37090ae902ed8dd87fa68578fa17cf3cf9b223b91c5c648e8b3e492030f026a6253aa28efaaf16633f2

    • SSDEEP

      3072:YKiT13Tc5d/Lb4dc+oytXrlvfYa1f+Mxn5B:E1E/vD+Z2aJ+Mx

    Score
    10/10
    redlinesmokeloaderinstall1partlogsdiller cloud (tg: @mr_golds)backdoordiscoveryinfostealerspywarestealertrojan

    • Detects Smokeloader packer

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

      trojanbackdoorsmokeloader

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Legitimate hosting services abused for malware hosting/C2

    • Suspicious use of SetThreadContext

    behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

2
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

1
T1082

Lateral Movement

Collection

Data from Local System

2
T1005

Exfiltration

Command and Control

Web Service

1
T1102

Impact

Tasks