Overview

overview

10

Static

static

dridex

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    dfdea8e5cc329e17847e129d8e515043b0dba31f1af48304f28dd181483607ae

  • Size

    847KB

  • Sample

    220815-km8nqabcg8

  • MD5

    200bbb757192fb530d38711a112338ba

  • SHA1

    259c77525cf161a376a07ed9a035c3064e2a1f17

  • SHA256

    dfdea8e5cc329e17847e129d8e515043b0dba31f1af48304f28dd181483607ae

  • SHA512

    b387ea9263598db899501f202f754e0bbc39b72be177857809a70fc4608310b46e00fe9d96e9cc00d2a2c9ce48bec764f0f4aaa989724d0079711b8cd37866ea

Score
10/10
blustealerstormkittycollectionstealer

Malware Config

Targets

    • Target

      dfdea8e5cc329e17847e129d8e515043b0dba31f1af48304f28dd181483607ae

    • Size

      847KB

    • MD5

      200bbb757192fb530d38711a112338ba

    • SHA1

      259c77525cf161a376a07ed9a035c3064e2a1f17

    • SHA256

      dfdea8e5cc329e17847e129d8e515043b0dba31f1af48304f28dd181483607ae

    • SHA512

      b387ea9263598db899501f202f754e0bbc39b72be177857809a70fc4608310b46e00fe9d96e9cc00d2a2c9ce48bec764f0f4aaa989724d0079711b8cd37866ea

    Score
    10/10
    blustealerstormkittycollectionstealer

    • BluStealer

      A Modular information stealer written in Visual Basic.

      stealerblustealer

    • StormKitty

      StormKitty is an open source info stealer written in C#.

      stealerstormkitty

    • StormKitty payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Accesses Microsoft Outlook profiles

      collection

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1

MITRE ATT&CK Enterprise v6

Tasks