MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7ba44f9bf826852b97d7fd37af4450957684acdea533f27440e8bfb5db1cd729. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Dridex


Vendor detections: 7


Intelligence 7 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7ba44f9bf826852b97d7fd37af4450957684acdea533f27440e8bfb5db1cd729
SHA3-384 hash: 27395c916351e46c1701c4d4c832c0360c98b095a38ef0589b0d4bf2c9fae969c3073509a92b7873d0e214c95071e9d3
SHA1 hash: 50e72b88256c7807853bea80c0c660a503383f75
MD5 hash: 0597e704a1234f7f0a2cc4dd823194cb
humanhash: lithium-one-mockingbird-nine
File name:7ba44f9bf826852b97d7fd37af4450957684acdea533f27440e8bfb5db1cd729
Download: download sample
Signature Dridex
Create hunting rule
File size:729'088 bytes
First seen:2021-08-31 10:23:33 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash c6b4c2eec8a93016c63563421e15f011 (66 x Dridex)
ssdeep 12288:1dMIwS97wJs6tSKDXEabXaC+jhc1S8XXk7CZzHsZH9dq0T:bMIJxSDX3bqjhcfHk7MzH6z
Threatray 30 similar samples on MalwareBazaar
TLSH T1BDF4E054B6B7A1CAC4A76CF6EDF86D706A522CC3623047A1CE02D1861B751E4CDF2A27
dhash icon 44b2686938d8cc00 (67 x Dridex)
Reporter JAMESWT_WT
Tags:Dridex exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
437
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
7ba44f9bf826852b97d7fd37af4450957684acdea533f27440e8bfb5db1cd729
Verdict:
No threats detected
Analysis date:
2021-08-31 10:55:15 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/5625121a-217a-4f32-b810-18450a354af7

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/184133/
Detection(s):
Win.Dropper.Dridex-9875456-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Changing a file
Replacing files
Sending a UDP request
Creating a file
Creating a process from a recently created file
Deleting a recently created file
Creating a file in the %AppData% subdirectories
Setting browser functions hooks
Forced shutdown of a system process
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Unauthorized injection to a system process
Unauthorized injection to a browser process
Forced shutdown of a browser
Enabling autorun by creating a file
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/c2a2aac8-9d80-47b2-b64f-17c76a3c708c
Result
Threat name:
Dridex
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
76 / 100
Link:
https://www.joesandbox.com/analysis/842520
Signature
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
PE file has nameless sections
Potential time zone aware malware
Queues an APC in another process (thread injection)
Uses Windows timers to delay execution
Yara detected Dridex unpacked file
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 474951 Sample: cQDJd8enSF.dll Startdate: 31/08/2021 Architecture: WINDOWS Score: 76 34 Multi AV Scanner detection for submitted file 2->34 36 Yara detected Dridex unpacked file 2->36 38 Machine Learning detection for sample 2->38 40 PE file has nameless sections 2->40 7 explorer.exe 1 125 2->7         started        11 loaddll64.exe 1 2->11         started        13 explorer.exe 2->13         started        15 explorer.exe 2->15         started        process3 dnsIp4 30 192.168.2.1 unknown unknown 7->30 42 Uses Windows timers to delay execution 7->42 44 Potential time zone aware malware 7->44 17 rundll32.exe 11->17         started        20 cmd.exe 1 11->20         started        22 rundll32.exe 11->22         started        24 14 other processes 11->24 signatures5 process6 signatures7 32 Queues an APC in another process (thread injection) 17->32 26 explorer.exe 17->26 injected 28 rundll32.exe 20->28         started        process8
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/7ba44f9bf826852b97d7fd37af4450957684acdea533f27440e8bfb5db1cd729/
Threat name:
Win64.Trojan.Injexa
Create hunting rule
Status:
Malicious
First seen:
2021-06-30 19:18:00 UTC
File Type:
PE+ (Dll)
Extracted files:
14
AV detection:
25 of 28 (89.29%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
dridex
Create hunting rule
Similar samples:
3aa8b08faadabb153fc00fc7b9445feb34a75e040b1c0e734242b1f76a9dc6db
Dridex
3ddb6d9dde6a6d38745c271e6ff4b6c045beabafa2fe9a607ac7b183a51cb9cf
Dridex
4b2cdc3fa6ed4bc76c8f19b0dfbc7fc013b4e889fabcacf57bbdda9138777f94
Dridex
4edb85bc25603bb33ddfec00d3258176ea15a736b566b01c298269333bf2b445
Dridex
9243b9644ef74212a00a79968b2f04c040824aeb470e7d3b4e76d57f1e415f2a
Dridex
9e7156a3ee3d864ea24daa5db9c90bc9505e034ed45dab8115490fda05c113d9
Dridex
aaf2fc168d40d3cb6ceca9a96a6aa61cb7a76afe08724bbfcd18d279098d6bfd
Dridex
b1afe9e1801792dfe96eb0a6c71aa98f82067c5454526a7a524a41d5bb8814ac
Dridex
c8880031f4a5f26ce43980ff969dea0afffac76bb6ca621af8cb304324ce2b33
Dridex
c9ac5bb27067f557bfe685c0f56e7f0c2c14cc20bfbcb630561edc266ab27fd3
Dridex
+ 20 additional samples on MalwareBazaar
Result
Malware family:
dridex
Create hunting rule
Score:
  10/10
Tags:
family:dridex botnet evasion payload persistence trojan
Link:
https://tria.ge/reports/210831-1981lr35h6/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of UnmapMainImage
Suspicious use of WriteProcessMemory
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Adds Run key to start application
Checks whether UAC is enabled
Loads dropped DLL
Executes dropped EXE
Dridex Payload
Dridex Shellcode
Dridex
Unpacked files
SH256 hash:
7ba44f9bf826852b97d7fd37af4450957684acdea533f27440e8bfb5db1cd729
MD5 hash:
0597e704a1234f7f0a2cc4dd823194cb
SHA1 hash:
50e72b88256c7807853bea80c0c660a503383f75
Link:
https://www.unpac.me/results/ae0981d4-92a0-40c7-9b45-c7465af9f769/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/7ba44f9bf826/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.72
Link:
https://yomi.yoroi.company/submissions/7ba44f9bf826852b97d7fd37af4450957684acdea533f27440e8bfb5db1cd729

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/184133/

Comments