Overview

overview

10

Static

static

dridex

windows10-1703-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    83c23e0e5a78274073184734dc75b606adaabc30732818a4cee8b932cc652309

  • Size

    318KB

  • Sample

    221205-qv2g9she4v

  • MD5

    c787989e02e83a224ae676ebac2c14a5

  • SHA1

    8f28793131e273a3da11dc17b5fd37bdbdb1ac12

  • SHA256

    83c23e0e5a78274073184734dc75b606adaabc30732818a4cee8b932cc652309

  • SHA512

    f59ed6839aa5d43c7e125b7eab1c5ceb983f4105f741e87aaa3b6cc4651665c62c034d830ac5898df10b27e35f43111faf39050b6cbe43ac6fa4d4e9a5b0cf99

  • SSDEEP

    6144:bs7iANOVjOY5dqX2PjzQU/0orBsLgIv02s+ODIne2U:b4NOVjOEzQ5YBkZvPNUIed

Score
10/10
amadeyredlinenashnewdef2023infostealerpersistencetrojan

Malware Config

Extracted

Family

amadey

Version

3.50

C2

31.41.244.167/v7eWcjs/index.php

Extracted

Family

redline

Botnet

Nash

C2

31.41.244.14:4694

Attributes
  • auth_value

    06b453aa751ccf8d7fad0602d3d70d22

Extracted

Family

redline

Botnet

NewDef2023

C2

185.106.92.214:2510

Attributes
  • auth_value

    048f34b18865578890538db10b2e9edf

Targets

    • Target

      83c23e0e5a78274073184734dc75b606adaabc30732818a4cee8b932cc652309

    • Size

      318KB

    • MD5

      c787989e02e83a224ae676ebac2c14a5

    • SHA1

      8f28793131e273a3da11dc17b5fd37bdbdb1ac12

    • SHA256

      83c23e0e5a78274073184734dc75b606adaabc30732818a4cee8b932cc652309

    • SHA512

      f59ed6839aa5d43c7e125b7eab1c5ceb983f4105f741e87aaa3b6cc4651665c62c034d830ac5898df10b27e35f43111faf39050b6cbe43ac6fa4d4e9a5b0cf99

    • SSDEEP

      6144:bs7iANOVjOY5dqX2PjzQU/0orBsLgIv02s+ODIne2U:b4NOVjOEzQ5YBkZvPNUIed

    Score
    10/10
    amadeyredlinenashnewdef2023infostealerpersistencetrojan

    • Amadey

      Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

      trojanamadey

    • Detect Amadey credential stealer module

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Registry Run Keys / Startup Folder

1
T1060

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks