Overview

overview

10

Static

static

dridex

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    63043e1230b491042c4a30039ae44055b99134597aaf5f659822dc321489992d
  • Size 5.3MB
  • Sample230118-ae8nmsfb7t
  • SHA256 63043e1230b491042c4a30039ae44055b99134597aaf5f659822dc321489992d
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
aurorarhadamanthysspywarestealer

Malware Config

Targets

    • Target
      63043e1230b491042c4a30039ae44055b99134597aaf5f659822dc321489992d
    • Size 5.3MB
    • SHA256 63043e1230b491042c4a30039ae44055b99134597aaf5f659822dc321489992d
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    aurorarhadamanthysspywarestealer

    • Aurora

      Aurora is a crypto wallet stealer written in Golang.

      stealeraurora

    • Detect rhadamanthys stealer shellcode

    • Rhadamanthys

      Rhadamanthys is an info stealer written in C++ first seen in August 2022.

      stealerrhadamanthys

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Loads dropped DLL

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1

MITRE ATT&CK Enterprise v6

Tasks