Overview

overview

10

Static

static

3

dridex

windows10-1703-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    dd45232f9da4a192825794ad78d27dbb52069e68ab6195a061b256adf1370be4

  • Size

    735KB

  • Sample

    230616-lvp21sea4z

  • MD5

    5bb03876a3c32288efd550ebd620a7c8

  • SHA1

    f93175ebc4826c9cd83fa3a9f75cb25ffa6eed82

  • SHA256

    dd45232f9da4a192825794ad78d27dbb52069e68ab6195a061b256adf1370be4

  • SHA512

    f8764739193bb4a1e1215c964eed72d6844e80ea9db06f0e09090bb1fa189f04871c51c8b8bcdfd8a7e1d9fc6eb73625159ab4e27edabc770bcdbaba96feea59

  • SSDEEP

    12288:4MrFy90kYZE1v0JR7kPJm7JW9iQ1yxGuWSaryB+ZiD277r+VkYa:9yaMvm7kPJm49iQ1garyB+wDRNa

Score
10/10
amadeyredlinedanajokerdiscoveryevasioninfostealerpersistencespywarestealertrojan

Malware Config

Extracted

Family

redline

Botnet

dana

C2

83.97.73.130:19061

Attributes
  • auth_value

    da2d1691db653e49676d799e1eae2673

Extracted

Family

amadey

Version

3.84

C2

77.91.68.63/doma/net/index.php

Extracted

Family

redline

Botnet

joker

C2

83.97.73.130:19061

Attributes
  • auth_value

    a98d303cc28bb3b32a23c59214ae3bc0

Targets

    • Target

      dd45232f9da4a192825794ad78d27dbb52069e68ab6195a061b256adf1370be4

    • Size

      735KB

    • MD5

      5bb03876a3c32288efd550ebd620a7c8

    • SHA1

      f93175ebc4826c9cd83fa3a9f75cb25ffa6eed82

    • SHA256

      dd45232f9da4a192825794ad78d27dbb52069e68ab6195a061b256adf1370be4

    • SHA512

      f8764739193bb4a1e1215c964eed72d6844e80ea9db06f0e09090bb1fa189f04871c51c8b8bcdfd8a7e1d9fc6eb73625159ab4e27edabc770bcdbaba96feea59

    • SSDEEP

      12288:4MrFy90kYZE1v0JR7kPJm7JW9iQ1yxGuWSaryB+ZiD277r+VkYa:9yaMvm7kPJm49iQ1garyB+wDRNa

    Score
    10/10
    amadeyredlinedanajokerdiscoveryevasioninfostealerpersistencespywarestealertrojan

    • Amadey

      Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

      trojanamadey

    • Modifies Windows Defender Real-time Protection settings

      evasiontrojan

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Windows security modification

      evasiontrojan

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1

MITRE ATT&CK Enterprise v6

Tasks