Overview

overview

10

Static

static

1

dridex

windows10-1703-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    e48e2b63852f1c9912c9020430b69a8af4e972a36772a75f4b4072882a45009d

  • Size

    701KB

  • Sample

    230327-t9f2nagd5z

  • MD5

    95317174f79d9763d85a42482e2e5dde

  • SHA1

    bb521d2cde9f4467d322d26ecc4098b87497438f

  • SHA256

    e48e2b63852f1c9912c9020430b69a8af4e972a36772a75f4b4072882a45009d

  • SHA512

    a470386bff66cacc6acf9f543c273fcfc29ff7a4a43924257ed785406bc68eaf362703aa3455a179304b48413855b3803dcd6cee37998ded43f64bdd2c77968e

  • SSDEEP

    12288:mMrLy90hJfkB34RqhO16MiFD0Ljst09PbkxSDqBRvouEEVgh:NyMJf2Nhw6rwLjfjqbEEVgh

Score
10/10
redlinesonyevasioninfostealerpersistencetrojan

Malware Config

Extracted

Family

redline

Botnet

sony

C2

193.233.20.33:4125

Attributes
  • auth_value

    1d93d1744381eeb4fcfd7c23ffe0f0b4

Targets

    • Target

      e48e2b63852f1c9912c9020430b69a8af4e972a36772a75f4b4072882a45009d

    • Size

      701KB

    • MD5

      95317174f79d9763d85a42482e2e5dde

    • SHA1

      bb521d2cde9f4467d322d26ecc4098b87497438f

    • SHA256

      e48e2b63852f1c9912c9020430b69a8af4e972a36772a75f4b4072882a45009d

    • SHA512

      a470386bff66cacc6acf9f543c273fcfc29ff7a4a43924257ed785406bc68eaf362703aa3455a179304b48413855b3803dcd6cee37998ded43f64bdd2c77968e

    • SSDEEP

      12288:mMrLy90hJfkB34RqhO16MiFD0Ljst09PbkxSDqBRvouEEVgh:NyMJf2Nhw6rwLjfjqbEEVgh

    Score
    10/10
    redlinesonyevasioninfostealerpersistencetrojan

    • Modifies Windows Defender Real-time Protection settings

      evasiontrojan

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • Executes dropped EXE

    • Windows security modification

      evasiontrojan

    • Adds Run key to start application

      persistence
    behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1
T1031

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

3
T1112

Disabling Security Tools

2
T1089

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks