Overview

overview

10

Static

static

3

dridex

windows10-1703-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ff6f9e2634dbeeeaded817e008e7dbe487c316a7546093de3fee20dfbc21b4bf

  • Size

    1.1MB

  • Sample

    230514-jas7tsdd5z

  • MD5

    41f6fa0bcb7ebbf71ba9f7bad407648e

  • SHA1

    c9947b3e67322b76afcc8a533fb481d73ae61b1c

  • SHA256

    ff6f9e2634dbeeeaded817e008e7dbe487c316a7546093de3fee20dfbc21b4bf

  • SHA512

    2d414a953c012b57c5e4cc38fc862d7540e2da472957d69e9d55b7c1a760f8b105e4c49bfaf8c11641fa6fe858d989284b3fe30b612350fb6152caf5e707f906

  • SSDEEP

    24576:byYK08jGLtsa5+k8WXxRYb04Qg43+F5yzmqRHtRk6g5w:OYBsatv5L1x14UiumYHIv5

Score
10/10
redlinelukaevasioninfostealerpersistencetrojan

Malware Config

Extracted

Family

redline

Botnet

luka

C2

185.161.248.75:4132

Attributes
  • auth_value

    44560bcd37d6bf076da309730fdb519a

Targets

    • Target

      ff6f9e2634dbeeeaded817e008e7dbe487c316a7546093de3fee20dfbc21b4bf

    • Size

      1.1MB

    • MD5

      41f6fa0bcb7ebbf71ba9f7bad407648e

    • SHA1

      c9947b3e67322b76afcc8a533fb481d73ae61b1c

    • SHA256

      ff6f9e2634dbeeeaded817e008e7dbe487c316a7546093de3fee20dfbc21b4bf

    • SHA512

      2d414a953c012b57c5e4cc38fc862d7540e2da472957d69e9d55b7c1a760f8b105e4c49bfaf8c11641fa6fe858d989284b3fe30b612350fb6152caf5e707f906

    • SSDEEP

      24576:byYK08jGLtsa5+k8WXxRYb04Qg43+F5yzmqRHtRk6g5w:OYBsatv5L1x14UiumYHIv5

    Score
    10/10
    redlinelukaevasioninfostealerpersistencetrojan

    • Modifies Windows Defender Real-time Protection settings

      evasiontrojan

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • Executes dropped EXE

    • Windows security modification

      evasiontrojan

    • Adds Run key to start application

      persistence
    behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1
T1031

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

3
T1112

Disabling Security Tools

2
T1089

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks