Overview

overview

10

Static

static

1

dridex

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    570b3b528d32058ef18f58d44af7c2b1f92687f65f8232cd59c19b79177aabb3

  • Size

    659KB

  • Sample

    230403-x3fzvsgf96

  • MD5

    79e8c53e0f6c262af86d950ce1c5f0d0

  • SHA1

    0f5bec8fde71a80c05f95d3a9e363757c5642c32

  • SHA256

    570b3b528d32058ef18f58d44af7c2b1f92687f65f8232cd59c19b79177aabb3

  • SHA512

    ca3400dc5f31322bf27c1628636acd23f5c0db87c06e7f37d1c92c1da509217ef8c5db7ecac683c66087d44ec4bb4d5b704778878862de1aa8a41a53e37854a1

  • SSDEEP

    12288:8MrKy90GBGozHfGVj/ySbc/ohJUApYFZSCMtuXI6+oOTB:GyRBGg+PbckJlDCMkf+oOd

Score
10/10
redlinerosnsporadiscoveryevasioninfostealerpersistencespywarestealertrojan

Malware Config

Extracted

Family

redline

Botnet

rosn

C2

176.113.115.145:4125

Attributes
  • auth_value

    050a19e1db4d0024b0f23b37dcf961f4

Extracted

Family

redline

Botnet

spora

C2

176.113.115.145:4125

Attributes
  • auth_value

    441b39ab37774b2ca9931c31e1bc6071

Targets

    • Target

      570b3b528d32058ef18f58d44af7c2b1f92687f65f8232cd59c19b79177aabb3

    • Size

      659KB

    • MD5

      79e8c53e0f6c262af86d950ce1c5f0d0

    • SHA1

      0f5bec8fde71a80c05f95d3a9e363757c5642c32

    • SHA256

      570b3b528d32058ef18f58d44af7c2b1f92687f65f8232cd59c19b79177aabb3

    • SHA512

      ca3400dc5f31322bf27c1628636acd23f5c0db87c06e7f37d1c92c1da509217ef8c5db7ecac683c66087d44ec4bb4d5b704778878862de1aa8a41a53e37854a1

    • SSDEEP

      12288:8MrKy90GBGozHfGVj/ySbc/ohJUApYFZSCMtuXI6+oOTB:GyRBGg+PbckJlDCMkf+oOd

    Score
    10/10
    redlinerosnsporadiscoveryevasioninfostealerpersistencespywarestealertrojan

    • Modifies Windows Defender Real-time Protection settings

      evasiontrojan

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Windows security modification

      evasiontrojan

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Suspicious use of SetThreadContext

    behavioral1

MITRE ATT&CK Enterprise v6

Tasks