Overview

overview

10

Static

static

dridex

windows10-1703-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    5c21069d9a242ee8583b0cf92c6ee80a3c2c0f4b50f451c5d38376c9ee7d83ec

  • Size

    474KB

  • Sample

    230125-mnczjsfg43

  • MD5

    2d23d0ffbe153bb4ebc6f53b2a441da7

  • SHA1

    4545ca6b1ef2eea782b23670cadbc90f342f0d6e

  • SHA256

    5c21069d9a242ee8583b0cf92c6ee80a3c2c0f4b50f451c5d38376c9ee7d83ec

  • SHA512

    af803cd2e910447f8fd469c6e3406032da6640ef079703502a11d5596aa22576f616fbac8ff46803eacc64c71e4377635ae2385b035b9477744446ed252012f1

  • SSDEEP

    12288:2zWqh1DXPMa6vLy5Rp/9lfuntJ37VWR5lzvd:rqTDkasGdFQnt17VWR5Vl

Score
10/10
redline@new@2023discoveryinfostealerspywarestealer

Malware Config

Extracted

Family

redline

Botnet

@new@2023

C2

77.73.133.62:22344

Attributes
  • auth_value

    8284279aedaed026a9b7cb9c1c0be4e4

Targets

    • Target

      5c21069d9a242ee8583b0cf92c6ee80a3c2c0f4b50f451c5d38376c9ee7d83ec

    • Size

      474KB

    • MD5

      2d23d0ffbe153bb4ebc6f53b2a441da7

    • SHA1

      4545ca6b1ef2eea782b23670cadbc90f342f0d6e

    • SHA256

      5c21069d9a242ee8583b0cf92c6ee80a3c2c0f4b50f451c5d38376c9ee7d83ec

    • SHA512

      af803cd2e910447f8fd469c6e3406032da6640ef079703502a11d5596aa22576f616fbac8ff46803eacc64c71e4377635ae2385b035b9477744446ed252012f1

    • SSDEEP

      12288:2zWqh1DXPMa6vLy5Rp/9lfuntJ37VWR5lzvd:rqTDkasGdFQnt17VWR5Vl

    Score
    10/10
    redline@new@2023discoveryinfostealerspywarestealer

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

1
T1012

Lateral Movement

Collection

Data from Local System

2
T1005

Exfiltration

Command and Control

Impact

Tasks