Overview

overview

10

Static

static

3

dridex

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    5b7f3d77e993fac1298763ac0fd267d38b4d67b41dfcaf41378014c0f8eeccf3

  • Size

    389KB

  • Sample

    230622-s8f5lafb76

  • MD5

    b56d33e0a71b12c005c09a99ca207588

  • SHA1

    361c096e05d01dc02fdbbe7b6978a221edb880e2

  • SHA256

    5b7f3d77e993fac1298763ac0fd267d38b4d67b41dfcaf41378014c0f8eeccf3

  • SHA512

    366fdd851b0ee1a7ffa36f47c1760f3a8f42290546240a5020037b4a23e7b4f64a617a63d0d5a8061e11936dabb8ef51d85f9d61023078ddc22a412c0e8b2fd7

  • SSDEEP

    12288:yztKe5jWeeIOFLpgmc0D57ABb0wTH1b/rbOxzrnb2OA8efJUZmM:yk9eeo3A6M

Score
10/10
redlinefurgadiscoveryinfostealerspywarestealer

Malware Config

Extracted

Family

redline

Botnet

furga

C2

83.97.73.128:19071

Attributes
  • auth_value

    1b7af6db7a79a3475798fcf494818be7

Targets

    • Target

      5b7f3d77e993fac1298763ac0fd267d38b4d67b41dfcaf41378014c0f8eeccf3

    • Size

      389KB

    • MD5

      b56d33e0a71b12c005c09a99ca207588

    • SHA1

      361c096e05d01dc02fdbbe7b6978a221edb880e2

    • SHA256

      5b7f3d77e993fac1298763ac0fd267d38b4d67b41dfcaf41378014c0f8eeccf3

    • SHA512

      366fdd851b0ee1a7ffa36f47c1760f3a8f42290546240a5020037b4a23e7b4f64a617a63d0d5a8061e11936dabb8ef51d85f9d61023078ddc22a412c0e8b2fd7

    • SSDEEP

      12288:yztKe5jWeeIOFLpgmc0D57ABb0wTH1b/rbOxzrnb2OA8efJUZmM:yk9eeo3A6M

    Score
    10/10
    redlinefurgadiscoveryinfostealerspywarestealer

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

1
T1012

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks