Overview

overview

10

Static

static

1

dridex

windows10-1703-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    80c2bbf17a49dba79ca018c54f6f35ac8c3252e788c6780e940494cf0dacf6b7

  • Size

    936KB

  • Sample

    230410-xmpbasfe84

  • MD5

    939a4b91c94501a89951e4c9b2ef9dac

  • SHA1

    7ee886a1b0668617d2d2b7f9cffabcde026dbdf9

  • SHA256

    80c2bbf17a49dba79ca018c54f6f35ac8c3252e788c6780e940494cf0dacf6b7

  • SHA512

    fa77d1f442db8b2cd51ee6afd4e6a9b7093a035732af210eee444ef33d168fa2b9bb74635177c57d2d7059e3bb622d97513fb8fbe18d80f23fed0e4ef739cc92

  • SSDEEP

    12288:WMrxSy90fbqhvOjNhacH7Vw3lneDbIzCpe+ahEWmKUZepuwE34x3+iCFzd28IczI:DSykqQ1Kj+ahtmKqeBT9+iKzd2ONrY

Score
10/10
amadeyredlinerosnzimadiscoveryevasioninfostealerpersistencespywarestealertrojan

Malware Config

Extracted

Family

redline

Botnet

rosn

C2

176.113.115.145:4125

Attributes
  • auth_value

    050a19e1db4d0024b0f23b37dcf961f4

Extracted

Family

redline

Botnet

zima

C2

176.113.115.145:4125

Attributes
  • auth_value

    2ef701d510c0d27e8a8e3270281678b1

Targets

    • Target

      80c2bbf17a49dba79ca018c54f6f35ac8c3252e788c6780e940494cf0dacf6b7

    • Size

      936KB

    • MD5

      939a4b91c94501a89951e4c9b2ef9dac

    • SHA1

      7ee886a1b0668617d2d2b7f9cffabcde026dbdf9

    • SHA256

      80c2bbf17a49dba79ca018c54f6f35ac8c3252e788c6780e940494cf0dacf6b7

    • SHA512

      fa77d1f442db8b2cd51ee6afd4e6a9b7093a035732af210eee444ef33d168fa2b9bb74635177c57d2d7059e3bb622d97513fb8fbe18d80f23fed0e4ef739cc92

    • SSDEEP

      12288:WMrxSy90fbqhvOjNhacH7Vw3lneDbIzCpe+ahEWmKUZepuwE34x3+iCFzd28IczI:DSykqQ1Kj+ahtmKqeBT9+iKzd2ONrY

    Score
    10/10
    amadeyredlinerosnzimadiscoveryevasioninfostealerpersistencespywarestealertrojan

    • Amadey

      Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

      trojanamadey

    • Modifies Windows Defender Real-time Protection settings

      evasiontrojan

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Windows security modification

      evasiontrojan

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1

MITRE ATT&CK Enterprise v6

Tasks