Overview

overview

10

Static

static

1

dridex

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    cc0f454b66b661eff55a13a25bab010651a2d2e5a413f0b914fe2d799d8e15d5

  • Size

    522KB

  • Sample

    230403-zjs67aha98

  • MD5

    8dd55f64a31134724343fa69648041fb

  • SHA1

    8fcb3c3deff9b61118e3965f4f4a8f278640ad08

  • SHA256

    cc0f454b66b661eff55a13a25bab010651a2d2e5a413f0b914fe2d799d8e15d5

  • SHA512

    c1917a0775cd43825100f60baa99d730f4b2acddcc4b449a98e9ab86aee7da4304e7df1aeb7ea4b9fc82258cef106738542f35033cf1fccbc28bd6f9c9cbdb02

  • SSDEEP

    12288:RMrJy90cORox6nx348+8qp4kJzWK5/8vRXpOzJ:oy3mIuqCkMKEXg

Score
10/10
redlinerosnsporadiscoveryevasioninfostealerpersistencespywarestealertrojan

Malware Config

Extracted

Family

redline

Botnet

rosn

C2

176.113.115.145:4125

Attributes
  • auth_value

    050a19e1db4d0024b0f23b37dcf961f4

Extracted

Family

redline

Botnet

spora

C2

176.113.115.145:4125

Attributes
  • auth_value

    441b39ab37774b2ca9931c31e1bc6071

Targets

    • Target

      cc0f454b66b661eff55a13a25bab010651a2d2e5a413f0b914fe2d799d8e15d5

    • Size

      522KB

    • MD5

      8dd55f64a31134724343fa69648041fb

    • SHA1

      8fcb3c3deff9b61118e3965f4f4a8f278640ad08

    • SHA256

      cc0f454b66b661eff55a13a25bab010651a2d2e5a413f0b914fe2d799d8e15d5

    • SHA512

      c1917a0775cd43825100f60baa99d730f4b2acddcc4b449a98e9ab86aee7da4304e7df1aeb7ea4b9fc82258cef106738542f35033cf1fccbc28bd6f9c9cbdb02

    • SSDEEP

      12288:RMrJy90cORox6nx348+8qp4kJzWK5/8vRXpOzJ:oy3mIuqCkMKEXg

    Score
    10/10
    redlinerosnsporadiscoveryevasioninfostealerpersistencespywarestealertrojan

    • Modifies Windows Defender Real-time Protection settings

      evasiontrojan

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Windows security modification

      evasiontrojan

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1

MITRE ATT&CK Enterprise v6

Tasks