Overview

overview

10

Static

static

3

dridex

windows10-1703-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    098e2047457a27b0e3ea12cc1e03ae11c371411b4964f4b735fe4fd4c5433e38

  • Size

    1.1MB

  • Sample

    230514-zjk6ksde69

  • MD5

    386c4ae4f55e0610aeffc8870d113266

  • SHA1

    805996346c3d8601eee22ca759d55cb1ce02df36

  • SHA256

    098e2047457a27b0e3ea12cc1e03ae11c371411b4964f4b735fe4fd4c5433e38

  • SHA512

    7cfb15dd9a48f477da7280317351ecb3e8434a7be0801dbdd50c8305dd503a066b0484692a7fec596d6c90bf3b7c42bb318e220781fecd5869b0d424f2aa2f0b

  • SSDEEP

    24576:+yt5ib8exPSPc6g2xdYfOQuu15v8V0tnMztRULTlbW:N68eQ06jDY2QPHv8etnq4tb

Score
10/10
redlinelindaevasioninfostealerpersistencetrojan

Malware Config

Extracted

Family

redline

Botnet

linda

C2

185.161.248.75:4132

Attributes
  • auth_value

    21cdc21d041667b9c1679f88a1146770

Targets

    • Target

      098e2047457a27b0e3ea12cc1e03ae11c371411b4964f4b735fe4fd4c5433e38

    • Size

      1.1MB

    • MD5

      386c4ae4f55e0610aeffc8870d113266

    • SHA1

      805996346c3d8601eee22ca759d55cb1ce02df36

    • SHA256

      098e2047457a27b0e3ea12cc1e03ae11c371411b4964f4b735fe4fd4c5433e38

    • SHA512

      7cfb15dd9a48f477da7280317351ecb3e8434a7be0801dbdd50c8305dd503a066b0484692a7fec596d6c90bf3b7c42bb318e220781fecd5869b0d424f2aa2f0b

    • SSDEEP

      24576:+yt5ib8exPSPc6g2xdYfOQuu15v8V0tnMztRULTlbW:N68eQ06jDY2QPHv8etnq4tb

    Score
    10/10
    redlinelindaevasioninfostealerpersistencetrojan

    • Modifies Windows Defender Real-time Protection settings

      evasiontrojan

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • Executes dropped EXE

    • Windows security modification

      evasiontrojan

    • Adds Run key to start application

      persistence
    behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1
T1031

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

3
T1112

Disabling Security Tools

2
T1089

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks