Overview

overview

10

Static

static

dridex

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d9a96e53db60df043c7b373172c4ae9cdff466c95c4d1098078fa7b9dd5b658f

  • Size

    1.5MB

  • Sample

    210926-zpa8kafcdm

  • MD5

    d0207b6877dfef5d280e429b6bbf0467

  • SHA1

    88b0aa6b364399d666f7566d85eae52dfbe53a76

  • SHA256

    d9a96e53db60df043c7b373172c4ae9cdff466c95c4d1098078fa7b9dd5b658f

  • SHA512

    8febe150144fcf93794c0da1f94be06624ca1797bae0d98cb708d2b4d677142b9a2dd70281c823ebe70c398b303de8ef311ad47c0669d1f4433b7f4166d13038

Score
10/10
vidarspywarestealer

Malware Config

Targets

    • Target

      d9a96e53db60df043c7b373172c4ae9cdff466c95c4d1098078fa7b9dd5b658f

    • Size

      1.5MB

    • MD5

      d0207b6877dfef5d280e429b6bbf0467

    • SHA1

      88b0aa6b364399d666f7566d85eae52dfbe53a76

    • SHA256

      d9a96e53db60df043c7b373172c4ae9cdff466c95c4d1098078fa7b9dd5b658f

    • SHA512

      8febe150144fcf93794c0da1f94be06624ca1797bae0d98cb708d2b4d677142b9a2dd70281c823ebe70c398b303de8ef311ad47c0669d1f4433b7f4166d13038

    Score
    10/10
    vidarspywarestealer

    • Suspicious use of NtCreateProcessExOtherParentProcess

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

      stealervidar

    • Vidar Stealer

      stealer

    • Downloads MZ/PE file

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses 2FA software files, possible credential harvesting

      spywarestealer
    behavioral1

MITRE ATT&CK Enterprise v6

Tasks