Overview

overview

10

Static

static

dridex

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    bebcc5ac655de4a13101d01e3c9fcfaa137de542e15654b0747eb77dc4b5636f

  • Size

    1.5MB

  • Sample

    210926-2ve5tafchk

  • MD5

    98377410d3a65b0f255a15213b2d1c58

  • SHA1

    3ecd5330e7d2bfd1ccdcc9568d601e8b965b2842

  • SHA256

    bebcc5ac655de4a13101d01e3c9fcfaa137de542e15654b0747eb77dc4b5636f

  • SHA512

    f2303ad2e5913d7b636a59ded255fee2f4f86fc77cac5c95990131ab511955a2185943fcb5d96f0b268a9cdf3675f047086dac42cd9c19128b0e96b3cad68d05

Score
10/10
vidarspywarestealer

Malware Config

Targets

    • Target

      bebcc5ac655de4a13101d01e3c9fcfaa137de542e15654b0747eb77dc4b5636f

    • Size

      1.5MB

    • MD5

      98377410d3a65b0f255a15213b2d1c58

    • SHA1

      3ecd5330e7d2bfd1ccdcc9568d601e8b965b2842

    • SHA256

      bebcc5ac655de4a13101d01e3c9fcfaa137de542e15654b0747eb77dc4b5636f

    • SHA512

      f2303ad2e5913d7b636a59ded255fee2f4f86fc77cac5c95990131ab511955a2185943fcb5d96f0b268a9cdf3675f047086dac42cd9c19128b0e96b3cad68d05

    Score
    10/10
    vidarspywarestealer

    • Suspicious use of NtCreateProcessExOtherParentProcess

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

      stealervidar

    • Vidar Stealer

      stealer

    • Downloads MZ/PE file

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses 2FA software files, possible credential harvesting

      spywarestealer
    behavioral1

MITRE ATT&CK Enterprise v6

Tasks