Overview

overview

10

Static

static

1

dridex

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    56b3802d563724bc2b467edbd35db0591a8aa8f6bd90c759ed22aa0a895b1a8d

  • Size

    533KB

  • Sample

    230331-1cn5bseh6t

  • MD5

    3e1226309f7343a1c3471ae5799ef76b

  • SHA1

    214044b86be3a3a40e785de0e62ec78bde022a6c

  • SHA256

    56b3802d563724bc2b467edbd35db0591a8aa8f6bd90c759ed22aa0a895b1a8d

  • SHA512

    d8fe8e756fcbcbb3443353cbef651bf2e3daed84c615e82269993921b4aa34703e0a707776e8854d459b04733ce6bd13929e76571258b1159010b72dc645fe96

  • SSDEEP

    12288:tMrBy90SV+fbhJS+fdr3LqHfNh+6HYp2:EyL+Th0+Fr3GHZ/

Score
10/10
redlinerosnsporadiscoveryevasioninfostealerpersistencespywarestealertrojan

Malware Config

Extracted

Family

redline

Botnet

rosn

C2

176.113.115.145:4125

Attributes
  • auth_value

    050a19e1db4d0024b0f23b37dcf961f4

Extracted

Family

redline

Botnet

spora

C2

176.113.115.145:4125

Attributes
  • auth_value

    441b39ab37774b2ca9931c31e1bc6071

Targets

    • Target

      56b3802d563724bc2b467edbd35db0591a8aa8f6bd90c759ed22aa0a895b1a8d

    • Size

      533KB

    • MD5

      3e1226309f7343a1c3471ae5799ef76b

    • SHA1

      214044b86be3a3a40e785de0e62ec78bde022a6c

    • SHA256

      56b3802d563724bc2b467edbd35db0591a8aa8f6bd90c759ed22aa0a895b1a8d

    • SHA512

      d8fe8e756fcbcbb3443353cbef651bf2e3daed84c615e82269993921b4aa34703e0a707776e8854d459b04733ce6bd13929e76571258b1159010b72dc645fe96

    • SSDEEP

      12288:tMrBy90SV+fbhJS+fdr3LqHfNh+6HYp2:EyL+Th0+Fr3GHZ/

    Score
    10/10
    redlinerosnsporadiscoveryevasioninfostealerpersistencespywarestealertrojan

    • Modifies Windows Defender Real-time Protection settings

      evasiontrojan

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Windows security modification

      evasiontrojan

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1

MITRE ATT&CK Enterprise v6

Tasks