MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fad001d463e892e7844040cabdcfa8f8431c07e7ef1ffd76ffbd190f49d7693d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Dridex


Vendor detections: 8


Intelligence 8 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: fad001d463e892e7844040cabdcfa8f8431c07e7ef1ffd76ffbd190f49d7693d
SHA3-384 hash: 73ba1ba89ace70238e68b6294afc7692bf18f8c0a10b09122f0cb6aa6a10802ebd09a504b5662f1bf679f61ed40b79ff
SHA1 hash: b9c820973407c7b4bef5b9ce98b7af62cafa397d
MD5 hash: d594e8a2098a81c9bfa24f3c17c992e6
humanhash: alabama-juliet-shade-north
File name:Report-24Sept.2020.scr
Download: download sample
Signature Dridex
Create hunting rule
File size:752'259 bytes
First seen:2020-09-24 12:44:47 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 4cfda23baf1e2e983ddfeca47a5c755a (33 x RedLineStealer, 6 x Dridex, 5 x NetSupport)
ssdeep 12288:EY20AljdZgBPfKfi1leppjfQxAogJfqsUsz0cX0rLfGLEXTMd8MQ5B5rxVCz:Z20gPgFKLfQxAVBbIcXQGL+MWMwTrxMz
Threatray 58 similar samples on MalwareBazaar
TLSH D4F4F1423181C8B6E82328F25CBDD231B074BD9E5275D60E3B826F2E5AF3752552B74B
Reporter JAMESWT_WT
Tags:Dridex

Intelligence

File Origin
# of uploads :
1
# of downloads :
171
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Detection(s):
SecuriteInfo.com.Trojan.PWS.Stealer.24943.1502.UNOFFICIAL
Create hunting rule

Result
Verdict:
Suspicious
Maliciousness:

Behaviour
Creating a window
Searching for the window
Creating a file
Creating a process from a recently created file
Running batch commands
Creating a process with a hidden window
Sending a UDP request
Launching a process
Moving a recently created file
Result
Threat name:
Unknown
Detection:
malicious
Classification:
n/a
Score:
68 / 100
Link:
https://www.joesandbox.com/analysis/474231
Signature
Drops batch files with force delete cmd (self deletion)
Machine Learning detection for dropped file
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Regsvr32 Anomaly
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 289561 Sample: Report-24Sept.2020.scr Startdate: 24/09/2020 Architecture: WINDOWS Score: 68 45 Multi AV Scanner detection for dropped file 2->45 47 Multi AV Scanner detection for submitted file 2->47 49 Machine Learning detection for dropped file 2->49 51 Sigma detected: Regsvr32 Anomaly 2->51 10 Report-24Sept.2020.exe 3 8 2->10         started        process3 file4 41 C:\XIU\configurate\dsep.bat, ASCII 10->41 dropped 43 C:\XIU\configurate\PLS.exe, PE32 10->43 dropped 53 Drops batch files with force delete cmd (self deletion) 10->53 14 wscript.exe 1 10->14         started        signatures5 process6 process7 16 cmd.exe 2 14->16         started        process8 18 PLS.exe 5 16->18         started        21 wscript.exe 1 16->21         started        23 conhost.exe 16->23         started        25 3 other processes 16->25 file9 37 C:\XIU\configurate\CONFIG.dll, PE32 18->37 dropped 39 C:\XIU\configurate\lll.bat, ASCII 18->39 dropped 27 cmd.exe 1 21->27         started        process10 process11 29 regsvr32.exe 27->29         started        31 conhost.exe 27->31         started        33 timeout.exe 1 27->33         started        35 attrib.exe 1 27->35         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/fad001d463e892e7844040cabdcfa8f8431c07e7ef1ffd76ffbd190f49d7693d/
Threat name:
Win32.Worm.Cridex
Create hunting rule
Status:
Malicious
First seen:
2020-09-24 12:45:00 UTC
File Type:
PE (Exe)
Extracted files:
10
AV detection:
23 of 29 (79.31%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
emotet
Create hunting rule
Similar samples:
1b13660c52adcccc1cef45f137a3373f5615500a609c61a9872e5ed4336e629a
Dridex
27dbff4b16fa15497def710d494b48ad90c3a498c354cee50fc0e35081dcfbb7
Dridex
2d40a6c3d1200616055b55031daa8a6b010b3c99219f6b6da87bcd2b2f27d6c2
Dridex
3a5943219f8400531a411b909b666337ba4f232d19e003a0128e0d699106f04f
Dridex
44c7ef261a066790a4ce332afc634fb5f89f3273c0c908ec02ab666088b27757
Dridex
5ade1071b7d6a1abe0b851d953fe1571f7372bce3d48f0adedfbbecd02c512c6
Dridex
73acff9ea3647f699cd645b09e652ca498eea7c5cee9f3cb573afda67a0ceeb2
Dridex
9492c6842475059a6af7f4b8c42e03944f08938243fa393713a5a6a930d79bcd
Dridex
cf1e8f2fc2dd05514be3e8f92abf5b266dfb1547cc611dabc0cc4eea5a1b7dfe
Dridex
fd869766f1f735b4c1479ec1300fd63f4a203142e4ed0e6ac18f05d1cdba3ac8
Dridex
+ 48 additional samples on MalwareBazaar
Result
Malware family:
dridex
Create hunting rule
Score:
  10/10
Tags:
botnet loader evasion family:dridex
Link:
https://tria.ge/reports/200924-7yc6h3trfa/
Behaviour
Delays execution with timeout.exe
Suspicious use of WriteProcessMemory
Views/modifies file attributes
Loads dropped DLL
Executes dropped EXE
Sets file to hidden
Dridex Loader
Dridex
Malware Config
C2 Extraction:
151.236.219.181:443
142.4.6.57:14043
162.144.127.197:3786
103.40.116.68:5443
Unpacked files
SH256 hash:
fad001d463e892e7844040cabdcfa8f8431c07e7ef1ffd76ffbd190f49d7693d
MD5 hash:
d594e8a2098a81c9bfa24f3c17c992e6
SHA1 hash:
b9c820973407c7b4bef5b9ce98b7af62cafa397d
Link:
https://www.unpac.me/results/7ae2fe52-6a4e-424e-8dd3-0f9ee606f064/
SH256 hash:
1deb4ead022da6eec655d4e60fb6b40b4663ee16fc04365663d566eb1629e7dc
MD5 hash:
933b41f031589f2aa3db3efad7c04fa5
SHA1 hash:
e6efb52ed115f067615dcfea7d8dc2b913bf6987
Link:
https://www.unpac.me/results/7ae2fe52-6a4e-424e-8dd3-0f9ee606f064/
SH256 hash:
533803428b0cedcb18c6d7057b338ac7b4eeee018fc0d92cb5eb32be4c7e0100
MD5 hash:
4e611789b71308f2a07cf1f94545cb8c
SHA1 hash:
21c04462a0334645463015f19a39efc40f9ce77c
Link:
https://www.unpac.me/results/7ae2fe52-6a4e-424e-8dd3-0f9ee606f064/
SH256 hash:
8b3182f4f819bdc27385b887aa4663febbea7689da430e38f860d38fd233a8b9
MD5 hash:
e32688a4c909486ca4ffd00c3d1e6c1b
SHA1 hash:
d945aee52f75e56e3fd6217432f28b224f016841
Detections:
win_dridex_auto
Create hunting rule
Link:
https://www.unpac.me/results/7ae2fe52-6a4e-424e-8dd3-0f9ee606f064/
Parent samples :
9492c6842475059a6af7f4b8c42e03944f08938243fa393713a5a6a930d79bcd
fad001d463e892e7844040cabdcfa8f8431c07e7ef1ffd76ffbd190f49d7693d
SH256 hash:
9492c6842475059a6af7f4b8c42e03944f08938243fa393713a5a6a930d79bcd
MD5 hash:
031f318c8ab815cda0d447904a925cf7
SHA1 hash:
2bbca22cb0355f1ad4acedd9dd69ebaaeddf6b9e
Link:
https://www.unpac.me/results/7ae2fe52-6a4e-424e-8dd3-0f9ee606f064/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
CoinMiner
Score:
0.60
Link:
https://yomi.yoroi.company/submissions/fad001d463e892e7844040cabdcfa8f8431c07e7ef1ffd76ffbd190f49d7693d

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:win_dridex_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/65381/

Comments