MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0494b125b6466f26f83f3a63b8b89fa9c6bf5ed36e5fcc2bbd5edfa56e122f99. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Dridex


Vendor detections: 3


Intelligence 3 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0494b125b6466f26f83f3a63b8b89fa9c6bf5ed36e5fcc2bbd5edfa56e122f99
SHA3-384 hash: 16d6ad6b08bb40455bd18be537c77668819ac4f94a1a73ef355349998a6e7ccfe6fb2bcfb1e0e6d1d2ada4b72109c8e9
SHA1 hash: c1374ec16dfcce49d2aab7783b050704075b8927
MD5 hash: 9d1bdc2bca0b7414e62555f3d97e0348
humanhash: rugby-oscar-carpet-georgia
File name:9d1bdc2bca0b7414e62555f3d97e0348.xls
Download: download sample
Signature Dridex
Create hunting rule
File size:942'592 bytes
First seen:2020-07-08 13:04:17 UTC
Last seen:Never
File type:Excel file xls
MIME type:application/vnd.ms-excel
ssdeep 24576:q/S9oL2WcnrIz+igZaYLllkZfGiFbthhXzin8kiL:tyL0rbigzL/kZfGiFbthhme
TLSH 6F152319AEDA2B9FCBF770385046C600EF0EDC67AB13550B9A057211BBB8DF284D616D
Reporter abuse_ch
Tags:Dridex xls


Avatar
abuse_ch
Dridex payload URL:
http://rocesi.com/mncejd.exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
273
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.Script.Generic.31533.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0494b125b6466f26f83f3a63b8b89fa9c6bf5ed36e5fcc2bbd5edfa56e122f99/
Threat name:
Document-Word.Downloader.EncDoc
Create hunting rule
Status:
Malicious
First seen:
2020-07-08 13:06:06 UTC
File Type:
Document
Extracted files:
3
AV detection:
15 of 29 (51.72%)
Threat level:
  3/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=asklcjnwizxsn6b7hjr3roe7vhdl6xwtnzp4yk55l3p2k3qsf6mq._file
Result
Malware family:
n/a
Score:
  8/10
Tags:
n/a
Link:
https://tria.ge/reports/200708-77b4s2nrw2/
Behaviour
Suspicious use of WriteProcessMemory
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: AddClipboardFormatListener
Suspicious use of SetWindowsHookEx
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Checks processor information in registry
Enumerates system info in registry
Suspicious use of SetWindowsHookEx
Suspicious behavior: AddClipboardFormatListener
Process spawned suspicious child process
Executes dropped EXE
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:SharedStrings
Create hunting rule
Author:Katie Kleemola
Description:Internal names found in LURK0/CCTV0 samples

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Dridex

Excel file xls 0494b125b6466f26f83f3a63b8b89fa9c6bf5ed36e5fcc2bbd5edfa56e122f99

(this sample)

Dridex

Executable exe f8c974a6572fd522a64d22da3bf36db7e912ccb700bd41623ed286f1e8b0e939

  
URLhaus
https://urlhaus.abuse.ch/url/408938/
  
Dropping
SHA256 f8c974a6572fd522a64d22da3bf36db7e912ccb700bd41623ed286f1e8b0e939
  
Dropping
MD5 7b5ef9ae32ebf6d68ac064f38eea2ce2

Comments