Overview

overview

10

Static

static

dridex

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    90203596e5a4c28eec4a53453233479d4f46aa122c28cac6c08c2b0baca95875

  • Size

    2.8MB

  • Sample

    220612-ny81eaadam

  • MD5

    d984a914514f03b8c85625f49cee892d

  • SHA1

    b3153ce0066527585f42f5f0ccdaef4a8cafbf0b

  • SHA256

    90203596e5a4c28eec4a53453233479d4f46aa122c28cac6c08c2b0baca95875

  • SHA512

    3399018b7f9eee1c1eb599ddf9b62aa0bc633c8c1c260cca9a8f19454fad181d42f11462f46b870a4b4d5de0d0dbf79bcb8e0e13c5c5107bbd01388c939bf2ed

Score
10/10
blackguardcollectionpersistencespywarestealersuricata

Malware Config

Targets

    • Target

      90203596e5a4c28eec4a53453233479d4f46aa122c28cac6c08c2b0baca95875

    • Size

      2.8MB

    • MD5

      d984a914514f03b8c85625f49cee892d

    • SHA1

      b3153ce0066527585f42f5f0ccdaef4a8cafbf0b

    • SHA256

      90203596e5a4c28eec4a53453233479d4f46aa122c28cac6c08c2b0baca95875

    • SHA512

      3399018b7f9eee1c1eb599ddf9b62aa0bc633c8c1c260cca9a8f19454fad181d42f11462f46b870a4b4d5de0d0dbf79bcb8e0e13c5c5107bbd01388c939bf2ed

    Score
    10/10
    blackguardcollectionpersistencespywarestealersuricata

    • BlackGuard

      Infostealer first seen in Late 2021.

      stealerblackguard

    • suricata: ET MALWARE BlackGuard_v2 Data Exfiltration Observed

      suricata: ET MALWARE BlackGuard_v2 Data Exfiltration Observed

      suricata

    • suricata: ET MALWARE MSIL/BlackGuard Stealer Exfil Activity

      suricata: ET MALWARE MSIL/BlackGuard Stealer Exfil Activity

      suricata

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Adds Run key to start application

      persistence
    behavioral1

MITRE ATT&CK Enterprise v6

Tasks