Overview

overview

10

Static

static

dridex

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    de509cf7db057a5fbabfa7b507a0ea097bc418955b5c7396661bad02496864ba

  • Size

    1.5MB

  • Sample

    210926-2m3adafcgq

  • MD5

    50eeeb37f11c7aa0d8faab2ba965bc10

  • SHA1

    e2d0e5c3f028dfbcc229842c05baed81aba713af

  • SHA256

    de509cf7db057a5fbabfa7b507a0ea097bc418955b5c7396661bad02496864ba

  • SHA512

    bf6fed739c733ef085129a4c24afbe6746e24f789a2197aa46b331cda79d24a888a1fcbeffcfef91e8e017043be0f5930bc3d1ff0fdcba8f64c828ca92e743e7

Score
10/10
vidarspywarestealer

Malware Config

Targets

    • Target

      de509cf7db057a5fbabfa7b507a0ea097bc418955b5c7396661bad02496864ba

    • Size

      1.5MB

    • MD5

      50eeeb37f11c7aa0d8faab2ba965bc10

    • SHA1

      e2d0e5c3f028dfbcc229842c05baed81aba713af

    • SHA256

      de509cf7db057a5fbabfa7b507a0ea097bc418955b5c7396661bad02496864ba

    • SHA512

      bf6fed739c733ef085129a4c24afbe6746e24f789a2197aa46b331cda79d24a888a1fcbeffcfef91e8e017043be0f5930bc3d1ff0fdcba8f64c828ca92e743e7

    Score
    10/10
    vidarspywarestealer

    • Suspicious use of NtCreateProcessExOtherParentProcess

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

      stealervidar

    • Vidar Stealer

      stealer

    • Downloads MZ/PE file

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses 2FA software files, possible credential harvesting

      spywarestealer
    behavioral1

MITRE ATT&CK Enterprise v6

Tasks