Overview

overview

10

Static

static

3

dridex

windows10-1703-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0865a79156e8aba94b0cdf71d1591fb77440978e6d5f25d081295cf73f289c3b

  • Size

    1.1MB

  • Sample

    230514-jqhe9sde2s

  • MD5

    52e2ba600f2f79ba0195280b8b3affc0

  • SHA1

    325c33cf51f02929b057cea2ed5b46226dbc094a

  • SHA256

    0865a79156e8aba94b0cdf71d1591fb77440978e6d5f25d081295cf73f289c3b

  • SHA512

    023d77cc9abf0c8556afe31bd82c7bc1e8a763ed3de890e40ca848b97f5368268617a4c48e4fb5ee1494522d1f83d8e7848a8748e3888f8df3c97d3da95f7bba

  • SSDEEP

    24576:AySRg6AY6JdkaBWIK7SPqRiK0iMHxMwFLLa39GwnRfazVQNQSF:HSpNceaAFWAiK0Ta6L1wMcQ

Score
10/10
redlinelukaevasioninfostealerpersistencetrojan

Malware Config

Extracted

Family

redline

Botnet

luka

C2

185.161.248.75:4132

Attributes
  • auth_value

    44560bcd37d6bf076da309730fdb519a

Targets

    • Target

      0865a79156e8aba94b0cdf71d1591fb77440978e6d5f25d081295cf73f289c3b

    • Size

      1.1MB

    • MD5

      52e2ba600f2f79ba0195280b8b3affc0

    • SHA1

      325c33cf51f02929b057cea2ed5b46226dbc094a

    • SHA256

      0865a79156e8aba94b0cdf71d1591fb77440978e6d5f25d081295cf73f289c3b

    • SHA512

      023d77cc9abf0c8556afe31bd82c7bc1e8a763ed3de890e40ca848b97f5368268617a4c48e4fb5ee1494522d1f83d8e7848a8748e3888f8df3c97d3da95f7bba

    • SSDEEP

      24576:AySRg6AY6JdkaBWIK7SPqRiK0iMHxMwFLLa39GwnRfazVQNQSF:HSpNceaAFWAiK0Ta6L1wMcQ

    Score
    10/10
    redlinelukaevasioninfostealerpersistencetrojan

    • Modifies Windows Defender Real-time Protection settings

      evasiontrojan

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • Executes dropped EXE

    • Windows security modification

      evasiontrojan

    • Adds Run key to start application

      persistence
    behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1
T1031

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

3
T1112

Disabling Security Tools

2
T1089

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks