Overview

overview

10

Static

static

3

dridex

windows10-1703-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    f2a437e641d98618a1bea3166015f38c7425e4b4b7d09c5b4caad9e8c3d7778d

  • Size

    309KB

  • Sample

    230601-h738madf2t

  • MD5

    8b21bf5024ad4613a239c73bbeb51040

  • SHA1

    e7506de7650aba7e006ad563d5952335f9de1784

  • SHA256

    f2a437e641d98618a1bea3166015f38c7425e4b4b7d09c5b4caad9e8c3d7778d

  • SHA512

    5fa99f2b980413070aa6231ee17b3d123d6b75de277b2e867bad1cf3828deae490c6d83a45ed999c2ad141600231c5830ba09a545dcf3daecd764a465ffb25b5

  • SSDEEP

    6144:eVaSG+RZHopB3NZ6i2oQpbkswv7aPowED:e6+RZ2OID7aPy

Score
10/10
vidara247b760bbf343752090be1436805458discoveryspywarestealer

Malware Config

Extracted

Family

vidar

Version

4.1

Botnet

a247b760bbf343752090be1436805458

C2

https://t.me/task4manager

http://23.88.46.113:80

https://steamcommunity.com/profiles/76561199510444991
Attributes
  • profile_id_v2

    a247b760bbf343752090be1436805458

  • user_agent

    Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Safari/537.36 Edg/112.0.1722.34

Targets

    • Target

      f2a437e641d98618a1bea3166015f38c7425e4b4b7d09c5b4caad9e8c3d7778d

    • Size

      309KB

    • MD5

      8b21bf5024ad4613a239c73bbeb51040

    • SHA1

      e7506de7650aba7e006ad563d5952335f9de1784

    • SHA256

      f2a437e641d98618a1bea3166015f38c7425e4b4b7d09c5b4caad9e8c3d7778d

    • SHA512

      5fa99f2b980413070aa6231ee17b3d123d6b75de277b2e867bad1cf3828deae490c6d83a45ed999c2ad141600231c5830ba09a545dcf3daecd764a465ffb25b5

    • SSDEEP

      6144:eVaSG+RZHopB3NZ6i2oQpbkswv7aPowED:e6+RZ2OID7aPy

    Score
    10/10
    vidara247b760bbf343752090be1436805458discoveryspywarestealer

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

      stealervidar

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses 2FA software files, possible credential harvesting

      spywarestealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1

MITRE ATT&CK Enterprise v6

Tasks