Overview

overview

10

Static

static

1

dridex

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    8223ef2a19067b340287e11150253ddfaa67aa809ea980be08614818e935a3e3

  • Size

    521KB

  • Sample

    230403-vn5zbshg6x

  • MD5

    9113ae97a93e5910d0a99561250756b2

  • SHA1

    c7d57b36efa36d2e4a6374f05c7f55c6205528fd

  • SHA256

    8223ef2a19067b340287e11150253ddfaa67aa809ea980be08614818e935a3e3

  • SHA512

    21d94ec2c328204bf10eac9c5ec8ce3df98f3be6995ce62b0b77ad45e714d704b259a591db90982982f2180b46f7e13e57ecff542fd6c250728eccd286b04b15

  • SSDEEP

    12288:iMrGy90BvOuVTlOjWucoqsOrLi4XcvwA1YLl:MyUGETkcvsO64Xcvw7Ll

Score
10/10
redlinerosnsporadiscoveryevasioninfostealerpersistencespywarestealertrojan

Malware Config

Extracted

Family

redline

Botnet

rosn

C2

176.113.115.145:4125

Attributes
  • auth_value

    050a19e1db4d0024b0f23b37dcf961f4

Extracted

Family

redline

Botnet

spora

C2

176.113.115.145:4125

Attributes
  • auth_value

    441b39ab37774b2ca9931c31e1bc6071

Targets

    • Target

      8223ef2a19067b340287e11150253ddfaa67aa809ea980be08614818e935a3e3

    • Size

      521KB

    • MD5

      9113ae97a93e5910d0a99561250756b2

    • SHA1

      c7d57b36efa36d2e4a6374f05c7f55c6205528fd

    • SHA256

      8223ef2a19067b340287e11150253ddfaa67aa809ea980be08614818e935a3e3

    • SHA512

      21d94ec2c328204bf10eac9c5ec8ce3df98f3be6995ce62b0b77ad45e714d704b259a591db90982982f2180b46f7e13e57ecff542fd6c250728eccd286b04b15

    • SSDEEP

      12288:iMrGy90BvOuVTlOjWucoqsOrLi4XcvwA1YLl:MyUGETkcvsO64Xcvw7Ll

    Score
    10/10
    redlinerosnsporadiscoveryevasioninfostealerpersistencespywarestealertrojan

    • Modifies Windows Defender Real-time Protection settings

      evasiontrojan

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Windows security modification

      evasiontrojan

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1

MITRE ATT&CK Enterprise v6

Tasks