Overview

overview

10

Static

static

dridex

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    10e3d143bb3bc8edb6a7dcb2878bcc515a163cd24ebd1e92e11e2443fd07e0d3

  • Size

    1.5MB

  • Sample

    210927-avsmcsfdh7

  • MD5

    85368f52786445baa32be18abc079987

  • SHA1

    501c9fe057108509d353c7b5728a5671a9731208

  • SHA256

    10e3d143bb3bc8edb6a7dcb2878bcc515a163cd24ebd1e92e11e2443fd07e0d3

  • SHA512

    b994c10bacec330b101f287d9b70c6b676a8468747fb5acdf2b3e9c0d0aacf780d868ae537c89bc7dc19ae5f66a27cd27cfcf1b20ac54918232c2f120ec50403

Score
10/10
vidarspywarestealer

Malware Config

Targets

    • Target

      10e3d143bb3bc8edb6a7dcb2878bcc515a163cd24ebd1e92e11e2443fd07e0d3

    • Size

      1.5MB

    • MD5

      85368f52786445baa32be18abc079987

    • SHA1

      501c9fe057108509d353c7b5728a5671a9731208

    • SHA256

      10e3d143bb3bc8edb6a7dcb2878bcc515a163cd24ebd1e92e11e2443fd07e0d3

    • SHA512

      b994c10bacec330b101f287d9b70c6b676a8468747fb5acdf2b3e9c0d0aacf780d868ae537c89bc7dc19ae5f66a27cd27cfcf1b20ac54918232c2f120ec50403

    Score
    10/10
    vidarspywarestealer

    • Suspicious use of NtCreateProcessExOtherParentProcess

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

      stealervidar

    • Vidar Stealer

      stealer

    • Downloads MZ/PE file

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses 2FA software files, possible credential harvesting

      spywarestealer
    behavioral1

MITRE ATT&CK Enterprise v6

Tasks