Overview

overview

10

Static

static

1

dridex

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    47047d70e0fe20957ddaa74655d804c7ed95d0f4982bf51ff573d8f8722c6f10

  • Size

    682KB

  • Sample

    230328-ldbhasbh3z

  • MD5

    f3d43aa1aba3589269b0040013ba2a98

  • SHA1

    f8b2d971f8a37c3509885f9987feaec6f1a83369

  • SHA256

    47047d70e0fe20957ddaa74655d804c7ed95d0f4982bf51ff573d8f8722c6f10

  • SHA512

    b4fa5a331a5d019f37a81b49e15da4b58da5733086debe49835155c5a226f5333bf1c6ac1b9593ec8ca90671c90c767da09ed2f128666c867d773321ff9155d2

  • SSDEEP

    12288:EMr8y90GGNmfAJPHOui2pTobKOrRCpC4JkGUktmMLFf12EzTrp:gyX2mWuuxp4NCRBmMLf2gp

Score
10/10
redlinefromrosndiscoveryevasioninfostealerpersistencespywarestealertrojan

Malware Config

Extracted

Family

redline

Botnet

rosn

C2

176.113.115.145:4125

Attributes
  • auth_value

    050a19e1db4d0024b0f23b37dcf961f4

Extracted

Family

redline

Botnet

from

C2

176.113.115.145:4125

Attributes
  • auth_value

    8633e283485822a4a48f0a41d5397566

Targets

    • Target

      47047d70e0fe20957ddaa74655d804c7ed95d0f4982bf51ff573d8f8722c6f10

    • Size

      682KB

    • MD5

      f3d43aa1aba3589269b0040013ba2a98

    • SHA1

      f8b2d971f8a37c3509885f9987feaec6f1a83369

    • SHA256

      47047d70e0fe20957ddaa74655d804c7ed95d0f4982bf51ff573d8f8722c6f10

    • SHA512

      b4fa5a331a5d019f37a81b49e15da4b58da5733086debe49835155c5a226f5333bf1c6ac1b9593ec8ca90671c90c767da09ed2f128666c867d773321ff9155d2

    • SSDEEP

      12288:EMr8y90GGNmfAJPHOui2pTobKOrRCpC4JkGUktmMLFf12EzTrp:gyX2mWuuxp4NCRBmMLf2gp

    Score
    10/10
    redlinefromrosndiscoveryevasioninfostealerpersistencespywarestealertrojan

    • Modifies Windows Defender Real-time Protection settings

      evasiontrojan

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Windows security modification

      evasiontrojan

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1
T1031

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

3
T1112

Disabling Security Tools

2
T1089

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

1
T1012

Lateral Movement

Collection

Data from Local System

2
T1005

Exfiltration

Command and Control

Impact

Tasks