MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 395ebad9dce58a546039d77911f86c274d7c0dc1869bd4eeb78d38133e9fee21. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Dridex

Vendor detections: 3

Intelligence 3 IOCs YARA 1 File information Comments

SHA256 hash:	395ebad9dce58a546039d77911f86c274d7c0dc1869bd4eeb78d38133e9fee21
SHA3-384 hash:	d7e5e0920da2949055009e063f2e3808795a3a2bf9f24b16e510b94d08ba86d773a64aad38052df4042c62b74ae49242
SHA1 hash:	a77dc13773843b8ff9e91977ec4a2c7c5e17b607
MD5 hash:	dcea304495cf7616a1598dfc9f4fc0b8
humanhash:	twenty-golf-ten-magazine
File name:	0406464.xls
Download:	download sample
Signature	Dridex Create hunting rule
File size:	340'480 bytes
First seen:	2020-07-13 13:05:48 UTC
Last seen:	Never
File type:	xls
MIME type:	application/vnd.ms-excel
ssdeep	6144:tMNMNnqN0sNGfhdWGb0lYSVGaP88BpEscse8y7f/zVAGzGFXWDxpJ:tdqN0swfD7g+2988nEDdZATElpJ
TLSH	397412ABF85DA647C3770B7E06692A060FD0ED25432F28590AC9777661B3F641806CCE
Reporter	abuse_ch
Tags:	Dridex xls

abuse_ch

Malspam distributing Dridex:

HELO: ou.sloweconomyconsultant.com
Sending IP: 45.135.132.71
From: Brynn Rosalinde <info@ou.sloweconomyconsultant.com>
Reply-To: info@boutiquedulivre.ca
Subject: RE: Invoice Due #2024795
Attachment: 0406464.xls

Dridex payload URL:
http://yumicha.xyz/lvkahex.exe

Botnet ID:
40400

Dridex C2s:
213.136.94.177:443
"217.20.166.178:4664
37.205.9.252:8443
70.39.251.94:3889

Intelligence

File Origin

# of uploads :

# of downloads :

266

Origin country :

n/a

Vendor Threat Intelligence

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/395ebad9dce58a546039d77911f86c274d7c0dc1869bd4eeb78d38133e9fee21/

Threat name:

Document-Word.Trojan.Abracadabra

Status:

Malicious

First seen:

2020-07-13 13:07:04 UTC

AV detection:

13 of 29 (44.83%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=hfplvwo44wffiybz254rd6dme5gxydobq2n5j3vxru4bgpu75yqq._file

Result

Malware family:

n/a

Score:

8/10

Tags:

n/a

Link:

https://tria.ge/reports/200713-zl5rfky4as/

Behaviour

Suspicious behavior: AddClipboardFormatListener

Suspicious use of SetWindowsHookEx

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of WriteProcessMemory

Checks processor information in registry

Enumerates system info in registry

Suspicious use of SetWindowsHookEx

Suspicious behavior: AddClipboardFormatListener

Process spawned suspicious child process

Executes dropped EXE

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.