Overview

overview

10

Static

static

3

dridex

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2fb6de4ff6816fe9db70ae103e31f39825c3e738180028431cc366d0d871d983

  • Size

    580KB

  • Sample

    230605-hpxm5afc52

  • MD5

    74961b3d2ba94680dd0a8a9945ee46a4

  • SHA1

    dab73096107320f74ca58566faffa5b35f3611b3

  • SHA256

    2fb6de4ff6816fe9db70ae103e31f39825c3e738180028431cc366d0d871d983

  • SHA512

    ec1122d3a25c143cc18ca945301a05630a98caf45e10c23fd28bfecc05c4d03c84592760d55a507bbe7317543f9c7ba0d99a896285d832b891a728a3f2df624b

  • SSDEEP

    12288:KMrly90HrbY2eFUvPUkHgJHmGo/79NjcX1aIcX:nyi4liImGoZNYl+

Score
10/10
redlinemaxievasioninfostealerpersistencetrojan

Malware Config

Extracted

Family

redline

Botnet

maxi

C2

83.97.73.126:19046

Attributes
  • auth_value

    6a3f22e5f4209b056a3fd330dc71956a

Targets

    • Target

      2fb6de4ff6816fe9db70ae103e31f39825c3e738180028431cc366d0d871d983

    • Size

      580KB

    • MD5

      74961b3d2ba94680dd0a8a9945ee46a4

    • SHA1

      dab73096107320f74ca58566faffa5b35f3611b3

    • SHA256

      2fb6de4ff6816fe9db70ae103e31f39825c3e738180028431cc366d0d871d983

    • SHA512

      ec1122d3a25c143cc18ca945301a05630a98caf45e10c23fd28bfecc05c4d03c84592760d55a507bbe7317543f9c7ba0d99a896285d832b891a728a3f2df624b

    • SSDEEP

      12288:KMrly90HrbY2eFUvPUkHgJHmGo/79NjcX1aIcX:nyi4liImGoZNYl+

    Score
    10/10
    redlinemaxievasioninfostealerpersistencetrojan

    • Modifies Windows Defender Real-time Protection settings

      evasiontrojan

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • Executes dropped EXE

    • Windows security modification

      evasiontrojan

    • Adds Run key to start application

      persistence
    behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1
T1031

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

3
T1112

Disabling Security Tools

2
T1089

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks