Overview

overview

10

Static

static

1

dridex

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    0941dc9cf6e9fe10983412fb7ca2766eb5917275e51200a7c4fda37a5eaecf1d

  • Size

    261KB

  • Sample

    230607-svhfhacg7y

  • MD5

    191247fb19cfabc4cd69370aae144b95

  • SHA1

    3a26e8e719e8e9aa9be2e646e4d7d7a2f6430751

  • SHA256

    0941dc9cf6e9fe10983412fb7ca2766eb5917275e51200a7c4fda37a5eaecf1d

  • SHA512

    593a74a69fe2e1ebf99e8104f4e87ea8439274a5343c59428c10797faef6b39aef1f86b12fcf09835f9b21a520d6a31d0c4df7920f30897eac53cc6ec1104b78

  • SSDEEP

    3072:khg7I71MeSRyHFaQ7RQ05CTEezbClXv8r8+oFe6gobFHFzA+E+2yQHcj/:Mgo1lFaQ7W05AEezbMPZFzAy2yA

Score
10/10
redlinesheroninfostealerspyware

Malware Config

Extracted

Family

redline

Botnet

sheron

C2

83.97.73.129:19068

Attributes
  • auth_value

    2d067e7e2372227d3a03b335260112e9

Targets

    • Target

      0941dc9cf6e9fe10983412fb7ca2766eb5917275e51200a7c4fda37a5eaecf1d

    • Size

      261KB

    • MD5

      191247fb19cfabc4cd69370aae144b95

    • SHA1

      3a26e8e719e8e9aa9be2e646e4d7d7a2f6430751

    • SHA256

      0941dc9cf6e9fe10983412fb7ca2766eb5917275e51200a7c4fda37a5eaecf1d

    • SHA512

      593a74a69fe2e1ebf99e8104f4e87ea8439274a5343c59428c10797faef6b39aef1f86b12fcf09835f9b21a520d6a31d0c4df7920f30897eac53cc6ec1104b78

    • SSDEEP

      3072:khg7I71MeSRyHFaQ7RQ05CTEezbClXv8r8+oFe6gobFHFzA+E+2yQHcj/:Mgo1lFaQ7W05AEezbMPZFzAy2yA

    Score
    10/10
    redlinesheroninfostealerspyware

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Suspicious use of SetThreadContext

    behavioral1

MITRE ATT&CK Enterprise v6

Tasks