Overview

overview

10

Static

static

dridex

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    463d19bd0702f6cd54b90f39f510f7e9f2b65d620ce82f16448c14d20d44c701

  • Size

    308KB

  • Sample

    220118-pznxasbcgp

  • MD5

    3c7f2b04ecee9907a321791c33387f90

  • SHA1

    ac0cbbf45d768a8c4acf698b143ec4c266436772

  • SHA256

    463d19bd0702f6cd54b90f39f510f7e9f2b65d620ce82f16448c14d20d44c701

  • SHA512

    5d24d4741ff8e24f5fea5cb0d6a1088bee74b31e953352dea449e8d99b2932a4886efb0678f25c1aa5800bdde20782d0c2039a60fcd93ba69f60d152d66cc3f2

Score
10/10
arkeidefaultdiscoveryspywarestealersuricata

Malware Config

Extracted

Family

arkei

Botnet

Default

C2

http://file-file-host4.com/tratata.php

Targets

    • Target

      463d19bd0702f6cd54b90f39f510f7e9f2b65d620ce82f16448c14d20d44c701

    • Size

      308KB

    • MD5

      3c7f2b04ecee9907a321791c33387f90

    • SHA1

      ac0cbbf45d768a8c4acf698b143ec4c266436772

    • SHA256

      463d19bd0702f6cd54b90f39f510f7e9f2b65d620ce82f16448c14d20d44c701

    • SHA512

      5d24d4741ff8e24f5fea5cb0d6a1088bee74b31e953352dea449e8d99b2932a4886efb0678f25c1aa5800bdde20782d0c2039a60fcd93ba69f60d152d66cc3f2

    Score
    10/10
    arkeidefaultdiscoveryspywarestealersuricata

    • Arkei

      Arkei is an infostealer written in C++.

      stealerarkei

    • suricata: ET MALWARE Win32/Vidar Variant Stealer CnC Exfil

      suricata: ET MALWARE Win32/Vidar Variant Stealer CnC Exfil

      suricata

    • Arkei Stealer Payload

      stealer

    • Downloads MZ/PE file

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Data from Local System

2
T1005

Exfiltration

Command and Control

Impact

Tasks