Overview

overview

10

Static

static

1

dridex

windows10-1703-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    e45d4f49ecc96f0f547227a02f637f7c9efffbb707a3d6e925ae1c59058be757

  • Size

    700KB

  • Sample

    230327-2vybdsff98

  • MD5

    545ae6221d77b17dface82c531f1cce9

  • SHA1

    2b5253d1b21c0f7d38e6fca82cb5a1cdd80cde67

  • SHA256

    e45d4f49ecc96f0f547227a02f637f7c9efffbb707a3d6e925ae1c59058be757

  • SHA512

    6b8236d73b76dfc3b496f1fe75511856a2fd4e248e58926aeb09ef43d5bca77d4656d2ef4068020cb94bc770de9d6813d4d56d82fcabf14754f611af3b96719f

  • SSDEEP

    12288:1Mr/y9062ZdylVnQ49DVFcAD8F/d9bq6UeNXHfISHmUi4tdwyM9yXmmvech:CylRD8hd9m6UeNXnmat6Gh

Score
10/10
redlinefromrosndiscoveryevasioninfostealerpersistencespywarestealertrojan

Malware Config

Extracted

Family

redline

Botnet

rosn

C2

176.113.115.145:4125

Attributes
  • auth_value

    050a19e1db4d0024b0f23b37dcf961f4

Extracted

Family

redline

Botnet

from

C2

176.113.115.145:4125

Attributes
  • auth_value

    8633e283485822a4a48f0a41d5397566

Targets

    • Target

      e45d4f49ecc96f0f547227a02f637f7c9efffbb707a3d6e925ae1c59058be757

    • Size

      700KB

    • MD5

      545ae6221d77b17dface82c531f1cce9

    • SHA1

      2b5253d1b21c0f7d38e6fca82cb5a1cdd80cde67

    • SHA256

      e45d4f49ecc96f0f547227a02f637f7c9efffbb707a3d6e925ae1c59058be757

    • SHA512

      6b8236d73b76dfc3b496f1fe75511856a2fd4e248e58926aeb09ef43d5bca77d4656d2ef4068020cb94bc770de9d6813d4d56d82fcabf14754f611af3b96719f

    • SSDEEP

      12288:1Mr/y9062ZdylVnQ49DVFcAD8F/d9bq6UeNXHfISHmUi4tdwyM9yXmmvech:CylRD8hd9m6UeNXnmat6Gh

    Score
    10/10
    redlinefromrosndiscoveryevasioninfostealerpersistencespywarestealertrojan

    • Modifies Windows Defender Real-time Protection settings

      evasiontrojan

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Windows security modification

      evasiontrojan

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1

MITRE ATT&CK Enterprise v6

Tasks