Overview

overview

10

Static

static

1

dridex

windows10-1703-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    fb79bf743f1d8ec783dffc9e68d31bbe19d8f26954bea74ba81b7842ae36a820

  • Size

    1.0MB

  • Sample

    230403-p1dgysgd5t

  • MD5

    1d2e530be1bc9a98c41429524a89c79e

  • SHA1

    bb11e3ba94fccdd21877c7180298c1df4f22d56b

  • SHA256

    fb79bf743f1d8ec783dffc9e68d31bbe19d8f26954bea74ba81b7842ae36a820

  • SHA512

    8ddcc3cbd113f6485ed6867489be2e1af0770e15b245fb5826248c6a6be5d230461e2dfbaab14d517588b781608591c73f7270ed5ebc684721aa2893e0670f37

  • SSDEEP

    12288:tUERECXjZB22OBZSw/dSamjZkyywVPjZtYx2jal5+MDfoRVmhOAPxysgzfkBKQza:tUSRz3LOjt/mywVr8

Score
10/10
agentteslacollectionkeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

Targets

    • Target

      fb79bf743f1d8ec783dffc9e68d31bbe19d8f26954bea74ba81b7842ae36a820

    • Size

      1.0MB

    • MD5

      1d2e530be1bc9a98c41429524a89c79e

    • SHA1

      bb11e3ba94fccdd21877c7180298c1df4f22d56b

    • SHA256

      fb79bf743f1d8ec783dffc9e68d31bbe19d8f26954bea74ba81b7842ae36a820

    • SHA512

      8ddcc3cbd113f6485ed6867489be2e1af0770e15b245fb5826248c6a6be5d230461e2dfbaab14d517588b781608591c73f7270ed5ebc684721aa2893e0670f37

    • SSDEEP

      12288:tUERECXjZB22OBZSw/dSamjZkyywVPjZtYx2jal5+MDfoRVmhOAPxysgzfkBKQza:tUSRz3LOjt/mywVr8

    Score
    10/10
    agentteslacollectionkeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

      spywarestealer

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Suspicious use of SetThreadContext

    behavioral1

MITRE ATT&CK Enterprise v6

Tasks