MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ca59948cbaec960d7b31ff1239c58d169b50dec11e57ab6201754362bf71b5fe. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Dridex


Vendor detections: 9


Intelligence 9 IOCs YARA File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ca59948cbaec960d7b31ff1239c58d169b50dec11e57ab6201754362bf71b5fe
SHA3-384 hash: e7c8c2ee443886fa4250ae38860a6b4c5957073b91213ca6cbcd34fc3a96e86018b91d36e5fd537f47ef207ea128e1c8
SHA1 hash: a8b3ba1efeea1b8540725a6e5fadb18cbc74cf85
MD5 hash: d5a362c7ce32460185d197495fc92d6b
humanhash: fish-saturn-glucose-spaghetti
File name:d5a362c7_by_Libranalysis
Download: download sample
Signature Dridex
Create hunting rule
File size:663'552 bytes
First seen:2021-04-29 19:07:41 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 2e106d2e0a27856802d8641844262145 (2 x Dridex)
ssdeep 12288:lrA/MryRXSExbPt8U1n+gSXBQ8RENnDWdOc1U4g0Tyt:J2Rfxbzn+jLmNqOZt
Threatray 16 similar samples on MalwareBazaar
TLSH 28E4E15BE9F878CCE0641537ADB64CF136ADBC9F41268199AE06CC084E9C329DD923D7
Reporter Libranalysis
Tags:Dridex


Avatar
Libranalysis
Uploaded as part of the sample sharing project

Intelligence

File Origin
# of uploads :
1
# of downloads :
95
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/146813/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Changing a file
Replacing files
Sending a UDP request
Creating a file
Creating a process from a recently created file
Deleting a recently created file
Creating a file in the %AppData% subdirectories
Setting browser functions hooks
Forced shutdown of a system process
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Unauthorized injection to a system process
Unauthorized injection to a browser process
Forced shutdown of a browser
Enabling autorun by creating a file
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
68 / 100
Link:
https://www.joesandbox.com/analysis/703014
Signature
Changes memory attributes in foreign processes to executable or writable
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
PE file has nameless sections
Potential time zone aware malware
Queues an APC in another process (thread injection)
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 400429 Sample: d5a362c7_by_Libranalysis.dll Startdate: 29/04/2021 Architecture: WINDOWS Score: 68 35 Multi AV Scanner detection for submitted file 2->35 37 Machine Learning detection for sample 2->37 39 PE file has nameless sections 2->39 7 loaddll64.exe 1 2->7         started        9 explorer.exe 103 2->9         started        12 explorer.exe 2->12         started        14 explorer.exe 2->14         started        process3 signatures4 16 rundll32.exe 7->16         started        19 rundll32.exe 7->19         started        21 cmd.exe 1 7->21         started        23 14 other processes 7->23 41 Potential time zone aware malware 9->41 process5 signatures6 31 Queues an APC in another process (thread injection) 16->31 25 explorer.exe 16->25 injected 33 Changes memory attributes in foreign processes to executable or writable 19->33 27 explorer.exe 19->27 injected 29 rundll32.exe 21->29         started        process7
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ca59948cbaec960d7b31ff1239c58d169b50dec11e57ab6201754362bf71b5fe/
Threat name:
Win64.Trojan.Phonzy
Create hunting rule
Status:
Malicious
First seen:
2021-04-29 19:08:15 UTC
AV detection:
21 of 47 (44.68%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=zjmzjdf25sla26zr74jdtrmnc2nvbxwbdzl2wyqbovbwfp3rwx7a._file
Verdict:
malicious
Label(s):
dridex
Create hunting rule
Similar samples:
2a7d98e350c431dcce79966d10ed36236a0fa0dfa113cec0d629ddb3faa43be2
Dridex
32733ed8cd439e049bff41a12686f66ddccf558a7ab68f4bfc014ec66bd0725b
Dridex
39aeb4b829dbaf57881874eb22330a8eb8440c9dc7dd49db912a0f05377a9c07
Dridex
3ddb6d9dde6a6d38745c271e6ff4b6c045beabafa2fe9a607ac7b183a51cb9cf
Dridex
62c3a9c66466f4bceff1f9d785b832af8f15f4ae1b07ec573ba2f43a0d7db308
Dridex
791fc1aa65ec3ae85a5441497344eed922c7e03720d086a58f17a63e038a6427
Dridex
9243b9644ef74212a00a79968b2f04c040824aeb470e7d3b4e76d57f1e415f2a
Dridex
b1afe9e1801792dfe96eb0a6c71aa98f82067c5454526a7a524a41d5bb8814ac
Dridex
c9ac5bb27067f557bfe685c0f56e7f0c2c14cc20bfbcb630561edc266ab27fd3
Dridex
d3096ae1aff66b900c5cc8e733e213cda2d01c55848aa8e91dec57f97cb95182
Dridex
+ 6 additional samples on MalwareBazaar
Result
Malware family:
dridex
Create hunting rule
Score:
  10/10
Tags:
family:dridex botnet evasion loader persistence trojan
Link:
https://tria.ge/reports/210429-8cgkhr9pvj/
Behaviour
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of UnmapMainImage
Suspicious use of WriteProcessMemory
Adds Run key to start application
Checks whether UAC is enabled
Loads dropped DLL
Executes dropped EXE
Dridex Loader
Dridex
Unpacked files
SH256 hash:
ca59948cbaec960d7b31ff1239c58d169b50dec11e57ab6201754362bf71b5fe
MD5 hash:
d5a362c7ce32460185d197495fc92d6b
SHA1 hash:
a8b3ba1efeea1b8540725a6e5fadb18cbc74cf85
Link:
https://www.unpac.me/results/f198c8fe-a6fb-4940-a347-f6a31531fc07/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/ca59948cbaec960d7b31ff1239c58d169b50dec11e57ab6201754362bf71b5fe

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/146813/

Comments


Avatar
a̵c̵c̸i̵d̷e̵n̷t̴a̷l̴r̵e̷b̸e̴l̸ commented on 2021-04-29 20:05:09 UTC

============================================================
MBC behaviors list (github.com/accidentalrebel/mbcscan):
============================================================
0) [B0009.029] Anti-Behavioral Analysis::Instruction Testing