Overview

overview

10

Static

static

1

dridex

windows10-1703-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    5d2b43bd3f39ebc9841bdd636084ea5620513b4f166e06262c95ff585e8ff310

  • Size

    698KB

  • Sample

    230328-m4hvqscc5s

  • MD5

    f33efd3d79311fa121bf5e634cb35132

  • SHA1

    ef4fe0cbe13d2c47c7c10cecc07c689a1f76e2f6

  • SHA256

    5d2b43bd3f39ebc9841bdd636084ea5620513b4f166e06262c95ff585e8ff310

  • SHA512

    ac343782c131d0c82651b050ed7f1c34e2bc1b816a8dc89bee451ae0055931773df7bf8bef5dbd2f9b46479046aabee55a431e587bc0a8c1196cbbaf2adae887

  • SSDEEP

    12288:6MrVy90NsqYd5cXO8Nez1wgysd/L66VGjeAxI9gV6Ivnzrx0:XyAGvcXODZ1yCrGjzI9Ev7ru

Score
10/10
redlinemuserosndiscoveryevasioninfostealerpersistencespywarestealertrojan

Malware Config

Extracted

Family

redline

Botnet

rosn

C2

176.113.115.145:4125

Attributes
  • auth_value

    050a19e1db4d0024b0f23b37dcf961f4

Extracted

Family

redline

Botnet

muse

C2

176.113.115.145:4125

Attributes
  • auth_value

    b91988a63a24940038d9262827a5320c

Targets

    • Target

      5d2b43bd3f39ebc9841bdd636084ea5620513b4f166e06262c95ff585e8ff310

    • Size

      698KB

    • MD5

      f33efd3d79311fa121bf5e634cb35132

    • SHA1

      ef4fe0cbe13d2c47c7c10cecc07c689a1f76e2f6

    • SHA256

      5d2b43bd3f39ebc9841bdd636084ea5620513b4f166e06262c95ff585e8ff310

    • SHA512

      ac343782c131d0c82651b050ed7f1c34e2bc1b816a8dc89bee451ae0055931773df7bf8bef5dbd2f9b46479046aabee55a431e587bc0a8c1196cbbaf2adae887

    • SSDEEP

      12288:6MrVy90NsqYd5cXO8Nez1wgysd/L66VGjeAxI9gV6Ivnzrx0:XyAGvcXODZ1yCrGjzI9Ev7ru

    Score
    10/10
    redlinemuserosndiscoveryevasioninfostealerpersistencespywarestealertrojan

    • Modifies Windows Defender Real-time Protection settings

      evasiontrojan

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Windows security modification

      evasiontrojan

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1

MITRE ATT&CK Enterprise v6

Tasks