Overview

overview

10

Static

static

dridex

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    423f74dc4702803f70b802d9c7b88b31a6a8e90af5928449067d45329d98cea4

  • Size

    1.5MB

  • Sample

    210926-tyrzsafadn

  • MD5

    8816c189f766a62c6ce8965b4540da64

  • SHA1

    7d6c37e672e6385bc7849e29c82b13d3869fc71e

  • SHA256

    423f74dc4702803f70b802d9c7b88b31a6a8e90af5928449067d45329d98cea4

  • SHA512

    6096d2a5804836af289d3ecc72f35660e500bed66b6e324d9d4d30d52a189102fd27838539a5a303f599f5ac0add525837402d988c8bbc963e2fb26bf645b283

Score
10/10
vidarspywarestealer

Malware Config

Targets

    • Target

      423f74dc4702803f70b802d9c7b88b31a6a8e90af5928449067d45329d98cea4

    • Size

      1.5MB

    • MD5

      8816c189f766a62c6ce8965b4540da64

    • SHA1

      7d6c37e672e6385bc7849e29c82b13d3869fc71e

    • SHA256

      423f74dc4702803f70b802d9c7b88b31a6a8e90af5928449067d45329d98cea4

    • SHA512

      6096d2a5804836af289d3ecc72f35660e500bed66b6e324d9d4d30d52a189102fd27838539a5a303f599f5ac0add525837402d988c8bbc963e2fb26bf645b283

    Score
    10/10
    vidarspywarestealer

    • Suspicious use of NtCreateProcessExOtherParentProcess

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

      stealervidar

    • Vidar Stealer

      stealer

    • Downloads MZ/PE file

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses 2FA software files, possible credential harvesting

      spywarestealer
    behavioral1

MITRE ATT&CK Enterprise v6

Tasks