Overview

overview

10

Static

static

1

dridex

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    94decd0a7b1650e3d798c5511e7a449ab46f387e5c50d723d4926b9004341c19

  • Size

    680KB

  • Sample

    230324-kksvgsfd2w

  • MD5

    9ed5492bc50820f751a9bad73380d92a

  • SHA1

    b971173484b43ece67211545801ddadf89a19404

  • SHA256

    94decd0a7b1650e3d798c5511e7a449ab46f387e5c50d723d4926b9004341c19

  • SHA512

    5b5886a7680d5d3cf068c98ef8a90f41621757c034e54e958721ec78514abc47b5a963f7e8fa16e01423b365ef44e8541f41be910c4fa8ccd37c8dc723812a88

  • SSDEEP

    12288:xd898Pwj8PtYzZcDw15fuFlAGHroV43S3OSWGAozw2XeSeTRn:xT08PtIsuup4IO6oz5VC1

Score
10/10
redlinedownherodiscoveryevasioninfostealerpersistencespywarestealertrojan

Malware Config

Extracted

Family

redline

Botnet

down

C2

193.233.20.31:4125

Attributes
  • auth_value

    12c31a90c72f5efae8c053a0bd339381

Extracted

Family

redline

Botnet

hero

C2

193.233.20.31:4125

Attributes
  • auth_value

    11f3c75a88ca461bcc8d6bf60a1193e3

Targets

    • Target

      94decd0a7b1650e3d798c5511e7a449ab46f387e5c50d723d4926b9004341c19

    • Size

      680KB

    • MD5

      9ed5492bc50820f751a9bad73380d92a

    • SHA1

      b971173484b43ece67211545801ddadf89a19404

    • SHA256

      94decd0a7b1650e3d798c5511e7a449ab46f387e5c50d723d4926b9004341c19

    • SHA512

      5b5886a7680d5d3cf068c98ef8a90f41621757c034e54e958721ec78514abc47b5a963f7e8fa16e01423b365ef44e8541f41be910c4fa8ccd37c8dc723812a88

    • SSDEEP

      12288:xd898Pwj8PtYzZcDw15fuFlAGHroV43S3OSWGAozw2XeSeTRn:xT08PtIsuup4IO6oz5VC1

    Score
    10/10
    redlinedownherodiscoveryevasioninfostealerpersistencespywarestealertrojan

    • Modifies Windows Defender Real-time Protection settings

      evasiontrojan

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Windows security modification

      evasiontrojan

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1

MITRE ATT&CK Enterprise v6

Tasks