Overview

overview

10

Static

static

dridex

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    8fe42b38498dc5c1d5625fedd343f0c1c98ddbeda80a21e78be213818260edd9

  • Size

    239KB

  • Sample

    221205-ytkgcsef7t

  • MD5

    929a75c8883a6901f1e857308d9a7cd9

  • SHA1

    d27de2c8820f3699e3fdf07c514a7bad01d06ab8

  • SHA256

    8fe42b38498dc5c1d5625fedd343f0c1c98ddbeda80a21e78be213818260edd9

  • SHA512

    bbe1e0faaa0d72206114cbeea81f52272891c5b3a968cc2bd79a6b110bc366581de315ba0b2c6bbd145d21e064fc1096c1523ddd46b6bb1eafb268031bf72ed3

  • SSDEEP

    3072:1x+Ugbyg6H8xK/q+PwjUoHp0DCe8K/1IzKbVR4TfGRrhqZIATc1mZxO:1x+UgWg5Kq+PwQoHp0DoK2KJSTfqrhmQ

Score
10/10
redline@p1infostealer

Malware Config

Extracted

Family

redline

Botnet

@P1

C2

193.106.191.138:32796

Attributes
  • auth_value

    54c79ce081122137049ee07c0a2f38ab

Targets

    • Target

      8fe42b38498dc5c1d5625fedd343f0c1c98ddbeda80a21e78be213818260edd9

    • Size

      239KB

    • MD5

      929a75c8883a6901f1e857308d9a7cd9

    • SHA1

      d27de2c8820f3699e3fdf07c514a7bad01d06ab8

    • SHA256

      8fe42b38498dc5c1d5625fedd343f0c1c98ddbeda80a21e78be213818260edd9

    • SHA512

      bbe1e0faaa0d72206114cbeea81f52272891c5b3a968cc2bd79a6b110bc366581de315ba0b2c6bbd145d21e064fc1096c1523ddd46b6bb1eafb268031bf72ed3

    • SSDEEP

      3072:1x+Ugbyg6H8xK/q+PwjUoHp0DCe8K/1IzKbVR4TfGRrhqZIATc1mZxO:1x+UgWg5Kq+PwQoHp0DoK2KJSTfqrhmQ

    Score
    10/10
    redline@p1infostealer

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • Uses the VBS compiler for execution

    • Suspicious use of SetThreadContext

    behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

1
T1064

Persistence

Privilege Escalation

Defense Evasion

Scripting

1
T1064

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks