Overview

overview

10

Static

static

dridex

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    fd370da22505523134e38b2bd79e769cb3875d2e774b5d6ac849b1e2c787a91c

  • Size

    1.5MB

  • Sample

    210927-a2ghnsfdbr

  • MD5

    418953cf070e16e1fd5ada62bc831326

  • SHA1

    e40c9594e2efdb7a532f2387bf19c26ef50eaac2

  • SHA256

    fd370da22505523134e38b2bd79e769cb3875d2e774b5d6ac849b1e2c787a91c

  • SHA512

    0f4e2e5e392b4cd1b0374f205d76085d33db3e364ac61700b10a920a4de88b0fbc6ff9b348e406c8c96debc46981b1f771f3e8d835511112bdf8127f40d9ee7d

Score
10/10
vidarspywarestealer

Malware Config

Targets

    • Target

      fd370da22505523134e38b2bd79e769cb3875d2e774b5d6ac849b1e2c787a91c

    • Size

      1.5MB

    • MD5

      418953cf070e16e1fd5ada62bc831326

    • SHA1

      e40c9594e2efdb7a532f2387bf19c26ef50eaac2

    • SHA256

      fd370da22505523134e38b2bd79e769cb3875d2e774b5d6ac849b1e2c787a91c

    • SHA512

      0f4e2e5e392b4cd1b0374f205d76085d33db3e364ac61700b10a920a4de88b0fbc6ff9b348e406c8c96debc46981b1f771f3e8d835511112bdf8127f40d9ee7d

    Score
    10/10
    vidarspywarestealer

    • Suspicious use of NtCreateProcessExOtherParentProcess

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

      stealervidar

    • Vidar Stealer

      stealer

    • Downloads MZ/PE file

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses 2FA software files, possible credential harvesting

      spywarestealer
    behavioral1

MITRE ATT&CK Enterprise v6

Tasks