Overview

overview

10

Static

static

dridex

windows10-1703-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    3acae017cf19e85f5c49fccc75df3701ac8fbdffe4dadfb7e1d748f2020ecc9e

  • Size

    247KB

  • Sample

    221113-yq739acg52

  • MD5

    b9897eadbf8761ccb2d5729551a3fabe

  • SHA1

    06de4303f9446799cfb97096400b5f6dcfe28ba6

  • SHA256

    3acae017cf19e85f5c49fccc75df3701ac8fbdffe4dadfb7e1d748f2020ecc9e

  • SHA512

    8b813c6472055e66da232b8e42e6673a32784730cb16daf8fd2a31aa7ef2f36ab9ded707fbf3acaab7c819f3ed987e40e112c3b14fd2db349a94f2ede79dc82b

  • SSDEEP

    3072:L+ejh0KBywzTJzQqDGqLM+K526fp6pa5AT6OFLfv2rSoPmmk7umhA+lXFi84KQ6a:lhjBpzQEM+96fIlX5dC4XgbJ65bZ4b

Score
10/10
redlinegoogle2infostealerspyware

Malware Config

Extracted

Family

redline

Botnet

Google2

C2

167.235.71.14:20469

Attributes
  • auth_value

    fb274d9691235ba015830da570a13578

Targets

    • Target

      3acae017cf19e85f5c49fccc75df3701ac8fbdffe4dadfb7e1d748f2020ecc9e

    • Size

      247KB

    • MD5

      b9897eadbf8761ccb2d5729551a3fabe

    • SHA1

      06de4303f9446799cfb97096400b5f6dcfe28ba6

    • SHA256

      3acae017cf19e85f5c49fccc75df3701ac8fbdffe4dadfb7e1d748f2020ecc9e

    • SHA512

      8b813c6472055e66da232b8e42e6673a32784730cb16daf8fd2a31aa7ef2f36ab9ded707fbf3acaab7c819f3ed987e40e112c3b14fd2db349a94f2ede79dc82b

    • SSDEEP

      3072:L+ejh0KBywzTJzQqDGqLM+K526fp6pa5AT6OFLfv2rSoPmmk7umhA+lXFi84KQ6a:lhjBpzQEM+96fIlX5dC4XgbJ65bZ4b

    Score
    10/10
    redlinegoogle2infostealerspyware

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • Uses the VBS compiler for execution

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Suspicious use of SetThreadContext

    behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

1
T1064

Persistence

Privilege Escalation

Defense Evasion

Scripting

1
T1064

Credential Access

Credentials in Files

1
T1081

Discovery

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks