Overview

overview

10

Static

static

dridex

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    7e7ba49822eb7f3bd7651e16901669d1c0e2e4bf5350893fa3d352f6060c5866

  • Size

    186KB

  • Sample

    221122-ctsxvaff34

  • MD5

    56a3a279691023743ec277c924199963

  • SHA1

    f4a5ee9d0babb6a0c8d3d5000af414ce28ce9340

  • SHA256

    7e7ba49822eb7f3bd7651e16901669d1c0e2e4bf5350893fa3d352f6060c5866

  • SHA512

    d66d9d5f30a4d752248135b50ba0c7d57a93284ec6e6b336294aeebbb8e1b677c5b0a97aa26ca5acb6aeae96380acfbb02ee3a79ec19482b230a359607ecdd23

  • SSDEEP

    3072:H+8UmyVpZFoWU8Sg5yVDB3vLzhV6C6hPYYKs:H+J/ot8wlj6CWPYYK

Score
10/10
amadeyredlinesmokeloaderkriptbackdoorinfostealertrojanupx

Malware Config

Extracted

Family

redline

Botnet

KRIPT

C2

212.8.246.157:32348

Attributes
  • auth_value

    80ebe4bab7a98a7ce9c75989ff9f40b4

Extracted

Family

amadey

Version

3.50

C2

193.56.146.174/g84kvj4jck/index.php

Targets

    • Target

      7e7ba49822eb7f3bd7651e16901669d1c0e2e4bf5350893fa3d352f6060c5866

    • Size

      186KB

    • MD5

      56a3a279691023743ec277c924199963

    • SHA1

      f4a5ee9d0babb6a0c8d3d5000af414ce28ce9340

    • SHA256

      7e7ba49822eb7f3bd7651e16901669d1c0e2e4bf5350893fa3d352f6060c5866

    • SHA512

      d66d9d5f30a4d752248135b50ba0c7d57a93284ec6e6b336294aeebbb8e1b677c5b0a97aa26ca5acb6aeae96380acfbb02ee3a79ec19482b230a359607ecdd23

    • SSDEEP

      3072:H+8UmyVpZFoWU8Sg5yVDB3vLzhV6C6hPYYKs:H+J/ot8wlj6CWPYYK

    Score
    10/10
    amadeyredlinesmokeloaderkriptbackdoorinfostealertrojanupx

    • Amadey

      Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

      trojanamadey

    • Detects Smokeloader packer

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

      trojanbackdoorsmokeloader

    • Downloads MZ/PE file

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Legitimate hosting services abused for malware hosting/C2

    • Suspicious use of SetThreadContext

    behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

3
T1082

Peripheral Device Discovery

1
T1120

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

1
T1102

Impact

Tasks