Overview

overview

10

Static

static

dridex

windows10-1703-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    811e6861542bfe869066462a16a6f75c8c7fd3eebe390c5d20bc67cfe3950dcf

  • Size

    2.2MB

  • Sample

    221209-ly7q8sfg4s

  • MD5

    7739a842dde39845c7bfae7936cf88ab

  • SHA1

    db7e1de369cce42977213d3b1d6ae899fde151d2

  • SHA256

    811e6861542bfe869066462a16a6f75c8c7fd3eebe390c5d20bc67cfe3950dcf

  • SHA512

    50ae804443ab5234ed7c8edeea2ed4d2206a594543450bb4738487726a59187132516a8590ef4c3c4bd1d06d2b4b81a60e3a42151ce4509ec4c609246bc76f68

  • SSDEEP

    49152:W+n6+R2XdaQIut4Fm4atPlbswaWmMxakTGhokMHPRj28U774cUGNSxL42N67:W+nF2XdjIBFm4atPlbswaW1xakTGhokX

Score
10/10
vidar1148discoveryspywarestealer

Malware Config

Extracted

Family

vidar

Version

56.1

Botnet

1148

C2

https://t.me/dishasta

https://steamcommunity.com/profiles/76561199441933804
Attributes
  • profile_id

    1148

Targets

    • Target

      811e6861542bfe869066462a16a6f75c8c7fd3eebe390c5d20bc67cfe3950dcf

    • Size

      2.2MB

    • MD5

      7739a842dde39845c7bfae7936cf88ab

    • SHA1

      db7e1de369cce42977213d3b1d6ae899fde151d2

    • SHA256

      811e6861542bfe869066462a16a6f75c8c7fd3eebe390c5d20bc67cfe3950dcf

    • SHA512

      50ae804443ab5234ed7c8edeea2ed4d2206a594543450bb4738487726a59187132516a8590ef4c3c4bd1d06d2b4b81a60e3a42151ce4509ec4c609246bc76f68

    • SSDEEP

      49152:W+n6+R2XdaQIut4Fm4atPlbswaWmMxakTGhokMHPRj28U774cUGNSxL42N67:W+nF2XdjIBFm4atPlbswaW1xakTGhokX

    Score
    10/10
    vidar1148discoveryspywarestealer

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

      stealervidar

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses 2FA software files, possible credential harvesting

      spywarestealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Suspicious use of SetThreadContext

    behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

3
T1081

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Data from Local System

3
T1005

Exfiltration

Command and Control

Impact

Tasks