MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4ef740da98b7a23dc32bf94dcf2f83aa48285d2c09859e59b456a0f2025b2b35. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Dridex

Vendor detections: 10

Intelligence 10 IOCs YARA 3 File information Comments 1

SHA256 hash:	4ef740da98b7a23dc32bf94dcf2f83aa48285d2c09859e59b456a0f2025b2b35
SHA3-384 hash:	c9f130ab7e96b917adda7e63bbc905f49342609e7f96b8b9efcedd85079987b8a32a1c2c6ddc49af67eb929caba3b086
SHA1 hash:	129362088a2f298ea4bfc38bcbbbc36b629ee850
MD5 hash:	e0ed159df2bb6b451816b8b48fd77ccb
humanhash:	moon-muppet-harry-winter
File name:	e0ed159df2bb6b451816b8b48fd77ccb
Download:	download sample
Signature	Dridex Create hunting rule
File size:	364'544 bytes
First seen:	2021-08-25 15:01:29 UTC
Last seen:	2021-08-25 18:09:21 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	e218f655f036f569d7a87ccfa333d177 (5 x CobaltStrike, 1 x Dridex)
ssdeep	6144:r61FoHY1j12PbimfGsE6m4FtWfAvpofL0tJ1PDi7wfaZwln/6kgUB9Z5Dr5kCvjb:lcj12PGYEgvIE9Di7orlikjOCvjbD0vL
Threatray	432 similar samples on MalwareBazaar
TLSH	T15E740160EBEA6555F5F77731A93A0721572E7D82A838F50C871042CE8A71AA5CDB0F33
Reporter	zbetcheckin
Tags:	32 Dridex exe

Intelligence

File Origin

# of uploads :

# of downloads :

732

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

e0ed159df2bb6b451816b8b48fd77ccb

Verdict:

Malicious activity

Analysis date:

2021-08-25 15:07:32 UTC

Tags:

trojan cobaltstrike

Link:

https://app.any.run/tasks/f750925f-8d43-4d48-99cb-3524f758f456

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

DridexV4

Link:

https://www.capesandbox.com/analysis/182342/

Result

Verdict:

Clean

Maliciousness:

Behaviour

Sending a UDP request

Malware family:

CobaltStrike Beacon

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/179fe11a-d91f-40f1-a03e-cf27fcab1448

Result

Threat name:

CobaltStrike

Detection:

malicious

Classification:

troj.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/839169

Signature

Antivirus detection for URL or domain

C2 URLs / IPs found in malware configuration

Contains functionality to detect sleep reduction / modifications

Detected unpacking (changes PE section rights)

Found malware configuration

Found potential dummy code loops (likely to delay analysis)

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Tries to detect sandboxes / dynamic malware analysis system (file name check)

Tries to detect virtualization through RDTSC time measurements

Yara detected CobaltStrike

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/4ef740da98b7a23dc32bf94dcf2f83aa48285d2c09859e59b456a0f2025b2b35/

Threat name:

Win32.Hacktool.CobaltStrike

Status:

Malicious

First seen:

2021-08-25 15:00:02 UTC

File Type:

PE (Exe)

AV detection:

14 of 27 (51.85%)

Threat level:

1/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=j33ubwuyw6rd3qzl7fg46l4dvjecqxjmbgcz4wnuk2qpeas3fm2q._file

Verdict:

malicious

Label(s):

cobaltstrike

Result

Malware family:

cobaltstrike

Score:

10/10

Tags:

family:cobaltstrike botnet:1359593325 backdoor trojan

Link:

https://tria.ge/reports/210825-2nyntqw26j/

Behaviour

Cobaltstrike

Malware Config

C2 Extraction:

http://37.120.206.118:80/push

Unpacked files

SH256 hash:

e9a1bf7f0f4c49847ba46b33408017d5ed0da3cdfc6c40a99b52476a7a96cf4a

MD5 hash:

2987e27161b40e9ce2ed1f2ca90052ec

SHA1 hash:

5289f23ab0e09dd4e107bcb82b5239ef03738d9e

Link:

https://www.unpac.me/results/12153a61-0537-4008-a934-738a14157522/

SH256 hash:

489b5fa519971f2b731dde6f0568fefc1e58db01b92a34204055739407e43d75

MD5 hash:

219cff1471ab7807dcb439905c13e986

SHA1 hash:

f6f501328756e393a980c3d373e0b9a237d6567e

Link:

https://www.unpac.me/results/12153a61-0537-4008-a934-738a14157522/

SH256 hash:

4ef740da98b7a23dc32bf94dcf2f83aa48285d2c09859e59b456a0f2025b2b35

MD5 hash:

e0ed159df2bb6b451816b8b48fd77ccb

SHA1 hash:

129362088a2f298ea4bfc38bcbbbc36b629ee850

Link:

https://www.unpac.me/results/12153a61-0537-4008-a934-738a14157522/

Malware family:

Cobalt Strike

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/4ef740da98b7/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.14

Link:

https://yomi.yoroi.company/submissions/4ef740da98b7a23dc32bf94dcf2f83aa48285d2c09859e59b456a0f2025b2b35

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	DridexV4 Create hunting rule
Author:	kevoreilly
Description:	Dridex v4 Payload

Rule name:	INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFuture Create hunting rule
Author:	ditekSHen
Description:	Detect executables with stomped PE compilation timestamp that is greater than local current time

Rule name:	Trojan_Win_Generic_101 Create hunting rule
Author:	FireEye
Description:	Detects FireEye Windows trojan
Reference:	https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html