Overview

overview

10

Static

static

dridex

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    45346004197c32fc53430c3422317f3e3d293db57a3e22a5716d836bc6d9fb93

  • Size

    1.5MB

  • Sample

    210926-yr2ymafcaj

  • MD5

    8c097b6781391d5d63f53788e40761ac

  • SHA1

    f9cab730cf75b12a1b73a019bbf2816e3733fa46

  • SHA256

    45346004197c32fc53430c3422317f3e3d293db57a3e22a5716d836bc6d9fb93

  • SHA512

    1c73932a326ce8a54407fcaa59305f4dd9e0d46b6c7b131d2ab077e1aa74ef6c46998c3a1d373060c2f18f052d615f7b5e657d38e8939647b6787aa92bc24a84

Score
10/10
vidarspywarestealer

Malware Config

Targets

    • Target

      45346004197c32fc53430c3422317f3e3d293db57a3e22a5716d836bc6d9fb93

    • Size

      1.5MB

    • MD5

      8c097b6781391d5d63f53788e40761ac

    • SHA1

      f9cab730cf75b12a1b73a019bbf2816e3733fa46

    • SHA256

      45346004197c32fc53430c3422317f3e3d293db57a3e22a5716d836bc6d9fb93

    • SHA512

      1c73932a326ce8a54407fcaa59305f4dd9e0d46b6c7b131d2ab077e1aa74ef6c46998c3a1d373060c2f18f052d615f7b5e657d38e8939647b6787aa92bc24a84

    Score
    10/10
    vidarspywarestealer

    • Suspicious use of NtCreateProcessExOtherParentProcess

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

      stealervidar

    • Vidar Stealer

      stealer

    • Downloads MZ/PE file

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses 2FA software files, possible credential harvesting

      spywarestealer
    behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2
T1081

Discovery

Lateral Movement

Collection

Data from Local System

2
T1005

Exfiltration

Command and Control

Impact

Tasks