Overview

overview

10

Static

static

1

dridex

windows10-1703-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    3160339335486b5f6ae7b219247c54463f92782c2324cc048b17f76d286a5216

  • Size

    1.1MB

  • Sample

    230220-yq3hrscb94

  • MD5

    a1e7ac1f09c253addbc9df8396045797

  • SHA1

    583f634f98e94ff2d30845c340138ce71753a186

  • SHA256

    3160339335486b5f6ae7b219247c54463f92782c2324cc048b17f76d286a5216

  • SHA512

    0e77b24c6afb5a8de5301d891335071849f0eb5f2ec871235abab42202fdcf0ed5e526cbda59c7b4fb0c5f18ebe2d4eb75e043a4a72bfc492d4f8a485cb17191

  • SSDEEP

    24576:FysxdPoE0/mVWsZJSTtpjygKIdfCEIeTAWK9vEIo72iB18/RPCO:gmdPV0+VWsZJSTPjr0PkAWwCBeZ

Score
10/10
amadeyauroraredlinerhadamanthysfucnakk1ronamcollectiondiscoveryevasioninfostealerpersistencespywarestealertrojanupx

Malware Config

Extracted

Family

redline

C2

85.31.44.66:17742

Attributes
  • auth_value

    e9a89e5b72a729171b1655add99ee280

Extracted

Family

redline

Botnet

ronam

C2

193.233.20.17:4139

Attributes
  • auth_value

    125421d19d14dd7fd211bc7f6d4aea6c

Extracted

Family

redline

Botnet

fucna

C2

193.233.20.17:4139

Attributes
  • auth_value

    16ab0f6ba753ccbeb028722745cf846f

Extracted

Family

redline

Botnet

kk1

C2

176.113.115.17:4132

Attributes
  • auth_value

    df169d3f7f631272f7c6bd9a1bb603c3

Extracted

Family

amadey

Version

3.67

C2

193.233.20.15/dF30Hn4m/index.php

Extracted

Family

amadey

Version

3.66

C2

62.204.41.88/9vdVVVjsw/index.php

Extracted

Family

amadey

Version

3.65

C2

77.73.134.27/8bmdh3Slb2/index.php

Extracted

Family

aurora

C2

167.235.18.89:8081

Targets

    • Target

      3160339335486b5f6ae7b219247c54463f92782c2324cc048b17f76d286a5216

    • Size

      1.1MB

    • MD5

      a1e7ac1f09c253addbc9df8396045797

    • SHA1

      583f634f98e94ff2d30845c340138ce71753a186

    • SHA256

      3160339335486b5f6ae7b219247c54463f92782c2324cc048b17f76d286a5216

    • SHA512

      0e77b24c6afb5a8de5301d891335071849f0eb5f2ec871235abab42202fdcf0ed5e526cbda59c7b4fb0c5f18ebe2d4eb75e043a4a72bfc492d4f8a485cb17191

    • SSDEEP

      24576:FysxdPoE0/mVWsZJSTtpjygKIdfCEIeTAWK9vEIo72iB18/RPCO:gmdPV0+VWsZJSTPjr0PkAWwCBeZ

    Score
    10/10
    amadeyauroraredlinerhadamanthysfucnakk1ronamcollectiondiscoveryevasioninfostealerpersistencespywarestealertrojanupx

    • Amadey

      Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

      trojanamadey

    • Aurora

      Aurora is a crypto wallet stealer written in Golang.

      stealeraurora

    • Detect rhadamanthys stealer shellcode

    • Modifies Windows Defender Real-time Protection settings

      evasiontrojan

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • Rhadamanthys

      Rhadamanthys is an info stealer written in C++ first seen in August 2022.

      stealerrhadamanthys

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Unexpected DNS network traffic destination

      Network traffic to other servers than the configured DNS servers was detected on the DNS port.

    • Uses the VBS compiler for execution

    • Windows security modification

      evasiontrojan

    • Accesses Microsoft Outlook profiles

      collection

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Drops desktop.ini file(s)

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Drops file in System32 directory

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1

MITRE ATT&CK Enterprise v6

Tasks