Overview

overview

10

Static

static

1

dridex

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    595e1dde24915d6442fa3d56c5d0f4e3fe9477682779884235c3c942dd4c5e61

  • Size

    539KB

  • Sample

    230324-kjk39afc9z

  • MD5

    0a72368742ea08d3d024aecae9758225

  • SHA1

    6facff767cb5a20279d04a1bfb5789cac88c0b71

  • SHA256

    595e1dde24915d6442fa3d56c5d0f4e3fe9477682779884235c3c942dd4c5e61

  • SHA512

    e82db511132ed724ce4d57dc38d5e5f5a809aef0ae14fb6ea771935a1b1f9c514f4499098c749b7fdfc5eca4316f12e02f2385fa74ae6b5166b10a8ffd8432a7

  • SSDEEP

    12288:vMrey90adwE0kd468jS1gb9exvI4+25DFWh7r4NP:ty1dw9FvS1gb9u6uDFqgNP

Score
10/10
redlinedownherodiscoveryevasioninfostealerpersistencespywarestealertrojan

Malware Config

Extracted

Family

redline

Botnet

down

C2

193.233.20.31:4125

Attributes
  • auth_value

    12c31a90c72f5efae8c053a0bd339381

Extracted

Family

redline

Botnet

hero

C2

193.233.20.31:4125

Attributes
  • auth_value

    11f3c75a88ca461bcc8d6bf60a1193e3

Targets

    • Target

      595e1dde24915d6442fa3d56c5d0f4e3fe9477682779884235c3c942dd4c5e61

    • Size

      539KB

    • MD5

      0a72368742ea08d3d024aecae9758225

    • SHA1

      6facff767cb5a20279d04a1bfb5789cac88c0b71

    • SHA256

      595e1dde24915d6442fa3d56c5d0f4e3fe9477682779884235c3c942dd4c5e61

    • SHA512

      e82db511132ed724ce4d57dc38d5e5f5a809aef0ae14fb6ea771935a1b1f9c514f4499098c749b7fdfc5eca4316f12e02f2385fa74ae6b5166b10a8ffd8432a7

    • SSDEEP

      12288:vMrey90adwE0kd468jS1gb9exvI4+25DFWh7r4NP:ty1dw9FvS1gb9u6uDFqgNP

    Score
    10/10
    redlinedownherodiscoveryevasioninfostealerpersistencespywarestealertrojan

    • Modifies Windows Defender Real-time Protection settings

      evasiontrojan

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Windows security modification

      evasiontrojan

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1

MITRE ATT&CK Enterprise v6

Tasks