Overview

overview

10

Static

static

3

dridex

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    ef03b88e801bc6bba6e7a7f82c5cde79bd756e93f663de0f3cc048858c104834

  • Size

    290KB

  • Sample

    231005-tjpk4sec57

  • MD5

    61b58ff95b06f484fdd263b7dca921e7

  • SHA1

    5e53323620dce30e7cb32b079b16c60757dffc1a

  • SHA256

    ef03b88e801bc6bba6e7a7f82c5cde79bd756e93f663de0f3cc048858c104834

  • SHA512

    75f1ddf33fdc63c64e88dc9530cb1f456d3774de5bcc11420f53663dee8b2e206d3cc613ca4716e2540a5a709c0afdcd4fd0ed0b1f8f1c5a1bb69bfcc36114a2

  • SSDEEP

    6144:QuC1pszt7Ngko9SnTnidA10Sjfc3VDeZhWSrmZy:QT1pszEko8Tni617jfeeZhWN

Score
10/10
vidar4841d6b1839c4fa7c20ecc420b82b347discoveryspywarestealer

Malware Config

Extracted

Family

vidar

Version

5.9

Botnet

4841d6b1839c4fa7c20ecc420b82b347

C2

https://steamcommunity.com/profiles/76561199557479327

https://t.me/grizmons
Attributes
  • profile_id_v2

    4841d6b1839c4fa7c20ecc420b82b347

  • user_agent

    Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 OPR/104.0.0.0

Targets

    • Target

      ef03b88e801bc6bba6e7a7f82c5cde79bd756e93f663de0f3cc048858c104834

    • Size

      290KB

    • MD5

      61b58ff95b06f484fdd263b7dca921e7

    • SHA1

      5e53323620dce30e7cb32b079b16c60757dffc1a

    • SHA256

      ef03b88e801bc6bba6e7a7f82c5cde79bd756e93f663de0f3cc048858c104834

    • SHA512

      75f1ddf33fdc63c64e88dc9530cb1f456d3774de5bcc11420f53663dee8b2e206d3cc613ca4716e2540a5a709c0afdcd4fd0ed0b1f8f1c5a1bb69bfcc36114a2

    • SSDEEP

      6144:QuC1pszt7Ngko9SnTnidA10Sjfc3VDeZhWSrmZy:QT1pszEko8Tni617jfeeZhWN

    Score
    10/10
    vidar4841d6b1839c4fa7c20ecc420b82b347discoveryspywarestealer

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

      stealervidar

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses 2FA software files, possible credential harvesting

      spywarestealer

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1

MITRE ATT&CK Enterprise v15

Tasks