Overview

overview

10

Static

static

dridex

windows10-1703-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    4fcbc17fc12ecf413b664e52177e48ea66e0e25581f144b4d1c4cac51c8346cf

  • Size

    1.4MB

  • Sample

    221207-sbmk4sad21

  • MD5

    ff8b52645b3eb0b891935435db2621a2

  • SHA1

    78b2977d5be3ec42af6cd29485acdd347395fc9f

  • SHA256

    4fcbc17fc12ecf413b664e52177e48ea66e0e25581f144b4d1c4cac51c8346cf

  • SHA512

    8c822285f60c1d54631692f033c4741e2eae02207b834c3432b5a2cec2bc3edaca73b9a4061559099e9cbb29845fb659705b5490e2eb6444adcdd733305fc08c

  • SSDEEP

    24576:cx0M2zdGz97lh4eb1DXNJ4X6Pi3hlIT6mN1+vjCFHnbfG:cZ1pDXzi3h66mN1+rSbf

Score
10/10
redlinevidarwarzonerat1569infostealerratstealer

Malware Config

Extracted

Family

vidar

Version

56.1

Botnet

1569

C2

https://t.me/dishasta

https://steamcommunity.com/profiles/76561199441933804
Attributes
  • profile_id

    1569

Targets

    • Target

      4fcbc17fc12ecf413b664e52177e48ea66e0e25581f144b4d1c4cac51c8346cf

    • Size

      1.4MB

    • MD5

      ff8b52645b3eb0b891935435db2621a2

    • SHA1

      78b2977d5be3ec42af6cd29485acdd347395fc9f

    • SHA256

      4fcbc17fc12ecf413b664e52177e48ea66e0e25581f144b4d1c4cac51c8346cf

    • SHA512

      8c822285f60c1d54631692f033c4741e2eae02207b834c3432b5a2cec2bc3edaca73b9a4061559099e9cbb29845fb659705b5490e2eb6444adcdd733305fc08c

    • SSDEEP

      24576:cx0M2zdGz97lh4eb1DXNJ4X6Pi3hlIT6mN1+vjCFHnbfG:cZ1pDXzi3h66mN1+rSbf

    Score
    10/10
    redlinevidarwarzonerat1569infostealerratstealer

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

      stealervidar

    • WarzoneRat, AveMaria

      WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

      ratinfostealerwarzonerat

    • .NET Reactor proctector

      Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

    • Warzone RAT payload

      rat

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Drops startup file

    • Loads dropped DLL

    • Legitimate hosting services abused for malware hosting/C2

    • Suspicious use of SetThreadContext

    behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1
T1082

Remote System Discovery

1
T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

1
T1102

Impact

Tasks