Overview

overview

10

Static

static

dridex

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d6e3ab5ed4fc57ae2eca188f36deae7bb5f337d15bbf8362276ebff1cc81169c

  • Size

    1.5MB

  • Sample

    210926-1er9rsfcfj

  • MD5

    4c9fbc9a750b81fe811d569099e0719c

  • SHA1

    e49a15253c87ae9c3704886f6e9337a5c4a7a123

  • SHA256

    d6e3ab5ed4fc57ae2eca188f36deae7bb5f337d15bbf8362276ebff1cc81169c

  • SHA512

    7169e3aa5591bb95c064e298d6742185ea75bb569958316d19fbb5bfc79c2b4a57e4f71149b873040c06e720c649a1a6d68d14d220bee808e4a6dccc126b5648

Score
10/10
vidarspywarestealer

Malware Config

Targets

    • Target

      d6e3ab5ed4fc57ae2eca188f36deae7bb5f337d15bbf8362276ebff1cc81169c

    • Size

      1.5MB

    • MD5

      4c9fbc9a750b81fe811d569099e0719c

    • SHA1

      e49a15253c87ae9c3704886f6e9337a5c4a7a123

    • SHA256

      d6e3ab5ed4fc57ae2eca188f36deae7bb5f337d15bbf8362276ebff1cc81169c

    • SHA512

      7169e3aa5591bb95c064e298d6742185ea75bb569958316d19fbb5bfc79c2b4a57e4f71149b873040c06e720c649a1a6d68d14d220bee808e4a6dccc126b5648

    Score
    10/10
    vidarspywarestealer

    • Suspicious use of NtCreateProcessExOtherParentProcess

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

      stealervidar

    • Vidar Stealer

      stealer

    • Downloads MZ/PE file

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses 2FA software files, possible credential harvesting

      spywarestealer
    behavioral1

MITRE ATT&CK Enterprise v6

Tasks