Overview

overview

10

Static

static

dridex

windows10-1703-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    c76592b7d6af661a15b6321308a27e054f49108b1a5b25d717636a241b384b93

  • Size

    808KB

  • Sample

    221026-rzw9safhh7

  • MD5

    10df064dddcb5b68b906c25579468f4d

  • SHA1

    8f5a298093a106b7207a199df202c6faa61ec4c0

  • SHA256

    c76592b7d6af661a15b6321308a27e054f49108b1a5b25d717636a241b384b93

  • SHA512

    008ca3ed7ef9ad9f719cc5a5cd5969a32ed27c51c57941da390aafdfc26e884fb424fb903929c41a6e9af8fcd35d568ac12c4b45910c302d66e28c3ef8a23cca

  • SSDEEP

    24576:9pfnKyOwZXOwkZSSh7/5vZATv5rG7vsO:TpaSSzs1ws

Score
10/10
agentteslacollectionkeyloggerspywarestealertrojan

Malware Config

Targets

    • Target

      c76592b7d6af661a15b6321308a27e054f49108b1a5b25d717636a241b384b93

    • Size

      808KB

    • MD5

      10df064dddcb5b68b906c25579468f4d

    • SHA1

      8f5a298093a106b7207a199df202c6faa61ec4c0

    • SHA256

      c76592b7d6af661a15b6321308a27e054f49108b1a5b25d717636a241b384b93

    • SHA512

      008ca3ed7ef9ad9f719cc5a5cd5969a32ed27c51c57941da390aafdfc26e884fb424fb903929c41a6e9af8fcd35d568ac12c4b45910c302d66e28c3ef8a23cca

    • SSDEEP

      24576:9pfnKyOwZXOwkZSSh7/5vZATv5rG7vsO:TpaSSzs1ws

    Score
    10/10
    agentteslacollectionkeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Accesses Microsoft Outlook profiles

      collection

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1

MITRE ATT&CK Enterprise v6

Tasks