Overview

overview

10

Static

static

dridex

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    a09e1de98b93b02c1d5350b818da7b691de39e3244551a7597921d5a802981e0

  • Size

    350KB

  • Sample

    220125-rlrr5sghbr

  • MD5

    dcac0a406d06056cfc54fc3307d2bebf

  • SHA1

    0da458df693359cb00e7e36ea540310f1cc2c65a

  • SHA256

    a09e1de98b93b02c1d5350b818da7b691de39e3244551a7597921d5a802981e0

  • SHA512

    768f5b89e7c6b902760763d95409e32f5f20cc770c35a0bbe6504b414e2701eec7cf7c97eef939cc64093566fdac0fe8dbe95734bd547fe47bf6414ec248de6e

Score
10/10
arkeidefaultdiscoveryspywarestealersuricata

Malware Config

Extracted

Family

arkei

Botnet

Default

C2

http://coin-file-file-19.com/tratata.php

Targets

    • Target

      a09e1de98b93b02c1d5350b818da7b691de39e3244551a7597921d5a802981e0

    • Size

      350KB

    • MD5

      dcac0a406d06056cfc54fc3307d2bebf

    • SHA1

      0da458df693359cb00e7e36ea540310f1cc2c65a

    • SHA256

      a09e1de98b93b02c1d5350b818da7b691de39e3244551a7597921d5a802981e0

    • SHA512

      768f5b89e7c6b902760763d95409e32f5f20cc770c35a0bbe6504b414e2701eec7cf7c97eef939cc64093566fdac0fe8dbe95734bd547fe47bf6414ec248de6e

    Score
    10/10
    arkeidefaultdiscoveryspywarestealersuricata

    • Arkei

      Arkei is an infostealer written in C++.

      stealerarkei

    • suricata: ET MALWARE Win32/Vidar Variant Stealer CnC Exfil

      suricata: ET MALWARE Win32/Vidar Variant Stealer CnC Exfil

      suricata

    • Arkei Stealer Payload

      stealer

    • Downloads MZ/PE file

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Data from Local System

2
T1005

Exfiltration

Command and Control

Impact

Tasks