Overview

overview

10

Static

static

1

dridex

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    df8b0ce1dc05903c93df00b64ea57706ab14f21bdc6cb55e2fd4727c694227cf

  • Size

    308KB

  • Sample

    230608-rp3c2sgg31

  • MD5

    dfa53fc9349d7cb85deb1e5dc0ef1734

  • SHA1

    7286e71c62ad3bb11f481f8765cadaa610c0485c

  • SHA256

    df8b0ce1dc05903c93df00b64ea57706ab14f21bdc6cb55e2fd4727c694227cf

  • SHA512

    9ee221e0d5e112bfbb9c4ebd967f14930ec11931f4cbeb5b3978a104b8be67446ddb39e2330d14fbf35a2307b55656649a1f7371ce22984f7d0811b5dead47f6

  • SSDEEP

    6144:3JiekRFHO/XwvTygXUNVS4MGh1aBFrvz1xcxcVtYP:3J4RckyR1aBFrvz1xcxyYP

Score
10/10
redlinesheroninfostealerspyware

Malware Config

Extracted

Family

redline

Botnet

sheron

C2

83.97.73.129:19068

Attributes
  • auth_value

    2d067e7e2372227d3a03b335260112e9

Targets

    • Target

      df8b0ce1dc05903c93df00b64ea57706ab14f21bdc6cb55e2fd4727c694227cf

    • Size

      308KB

    • MD5

      dfa53fc9349d7cb85deb1e5dc0ef1734

    • SHA1

      7286e71c62ad3bb11f481f8765cadaa610c0485c

    • SHA256

      df8b0ce1dc05903c93df00b64ea57706ab14f21bdc6cb55e2fd4727c694227cf

    • SHA512

      9ee221e0d5e112bfbb9c4ebd967f14930ec11931f4cbeb5b3978a104b8be67446ddb39e2330d14fbf35a2307b55656649a1f7371ce22984f7d0811b5dead47f6

    • SSDEEP

      6144:3JiekRFHO/XwvTygXUNVS4MGh1aBFrvz1xcxcVtYP:3J4RckyR1aBFrvz1xcxyYP

    Score
    10/10
    redlinesheroninfostealerspyware

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Suspicious use of SetThreadContext

    behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1
T1081

Discovery

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks