Overview

overview

10

Static

static

3

dridex

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    8c1dc60fe97bfdd5666d96b0854ef4dbed2784b18404243b38b8c17257668403

  • Size

    352KB

  • Sample

    230605-ls36vsgc5w

  • MD5

    da203bd4875de89c924b5b1c76ae06b8

  • SHA1

    7486eeedee8cbbd6ee08664d8f33996d7b17a93e

  • SHA256

    8c1dc60fe97bfdd5666d96b0854ef4dbed2784b18404243b38b8c17257668403

  • SHA512

    1a2b79f1150d1d08014a1b23822d4bb539a2dfc3684f3e373b989327ac6f9a596097116ca0e4d273f891100d63ac653f71332e64ee57948048f6fabe9baa58f9

  • SSDEEP

    6144:H4Y3IaoGk5igkmiDJnqoJk19zUt4ieqysMA6MIe:H3nk8DlNeLqyVA6Be

Score
10/10
redline@germanymicrosoftinfostealerphishing

Malware Config

Extracted

Family

redline

Botnet

@Germany

C2

185.81.68.115:2920

Attributes
  • auth_value

    9d15d78194367a949e54a07d6ce02c62

Targets

    • Target

      8c1dc60fe97bfdd5666d96b0854ef4dbed2784b18404243b38b8c17257668403

    • Size

      352KB

    • MD5

      da203bd4875de89c924b5b1c76ae06b8

    • SHA1

      7486eeedee8cbbd6ee08664d8f33996d7b17a93e

    • SHA256

      8c1dc60fe97bfdd5666d96b0854ef4dbed2784b18404243b38b8c17257668403

    • SHA512

      1a2b79f1150d1d08014a1b23822d4bb539a2dfc3684f3e373b989327ac6f9a596097116ca0e4d273f891100d63ac653f71332e64ee57948048f6fabe9baa58f9

    • SSDEEP

      6144:H4Y3IaoGk5igkmiDJnqoJk19zUt4ieqysMA6MIe:H3nk8DlNeLqyVA6Be

    Score
    10/10
    redline@germanymicrosoftinfostealerphishing

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • Detected potential entity reuse from brand microsoft.

      phishingmicrosoft

    • Suspicious use of SetThreadContext

    behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

2
T1082

Query Registry

1
T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks