Overview

overview

10

Static

static

dridex

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    ba4a7b03cc987f307f29a579c5553e9b262bf16d2d2c0a6738550b1abe03a1d7

  • Size

    1.0MB

  • Sample

    221020-qyj3dsgag9

  • MD5

    05c4ea4fdf2ce941385efba19a141efa

  • SHA1

    b6ef92ee7fc3673b807da1cd7893eee65b28a48c

  • SHA256

    ba4a7b03cc987f307f29a579c5553e9b262bf16d2d2c0a6738550b1abe03a1d7

  • SHA512

    16eeff2e6aabe2e28b13fe38c06fd13e5e105aa51caaed395c02a707bdf985962b32d250cad8ca60b2e955c4e1a463b26ac1fb806cd32b7bf3ba2456e605e1e5

  • SSDEEP

    12288:7ushbuhvqVlfEugEOxeCV4xRajkGjek4R/6UDbUTiUNj0lWeT9IJj8V:7XbKAckJ+ekC/6UDQm4rw9I1

Score
10/10
agentteslacollectionkeyloggerspywarestealertrojan

Malware Config

Targets

    • Target

      ba4a7b03cc987f307f29a579c5553e9b262bf16d2d2c0a6738550b1abe03a1d7

    • Size

      1.0MB

    • MD5

      05c4ea4fdf2ce941385efba19a141efa

    • SHA1

      b6ef92ee7fc3673b807da1cd7893eee65b28a48c

    • SHA256

      ba4a7b03cc987f307f29a579c5553e9b262bf16d2d2c0a6738550b1abe03a1d7

    • SHA512

      16eeff2e6aabe2e28b13fe38c06fd13e5e105aa51caaed395c02a707bdf985962b32d250cad8ca60b2e955c4e1a463b26ac1fb806cd32b7bf3ba2456e605e1e5

    • SSDEEP

      12288:7ushbuhvqVlfEugEOxeCV4xRajkGjek4R/6UDbUTiUNj0lWeT9IJj8V:7XbKAckJ+ekC/6UDQm4rw9I1

    Score
    10/10
    agentteslacollectionkeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Accesses Microsoft Outlook profiles

      collection

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1

MITRE ATT&CK Enterprise v6

Tasks