Advertisement
paladin316

859Dridex_4008dc3b2fca085762c9b8d9ca06fcc3_bin_2019-09-03_20_30.txt

Sep 3rd, 2019
1,382
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 7.86 KB | None | 0 0
  1.  
  2. * ID: 859
  3. * MalFamily: "Malicious"
  4.  
  5. * MalScore: 10.0
  6.  
  7. * File Name: "Dridex_4008dc3b2fca085762c9b8d9ca06fcc3.bin"
  8. * File Size: 352256
  9. * File Type: "PE32 executable (GUI) Intel 80386, for MS Windows"
  10. * SHA256: "77617cff003e8d9d9d98493d88b75de683d447d0360a0b390e429b14f75cf30e"
  11. * MD5: "4008dc3b2fca085762c9b8d9ca06fcc3"
  12. * SHA1: "bd0420512b9ee3a0cbaf0e40b6f0522aba15812a"
  13. * SHA512: "6a12ce1ccd4e90e9ec49364a395da9777bc61f0efffca543a264c659eca709e5dbced7f392ee4cd3bb67042ddbb064e39c8e28b144e87a100a38201506d60eb8"
  14. * CRC32: "53859DA9"
  15. * SSDEEP: "6144:XKf7YBW60YdeOAGnnKEY9XBK7g39xNDaYScur6bbvjZr:XKIWDY0OAixY9X4itDarju"
  16.  
  17. * Process Execution:
  18. "Av3q1e2VNYN1.exe"
  19.  
  20.  
  21. * Executed Commands:
  22.  
  23. * Signatures Detected:
  24.  
  25. "Description": "Behavioural detection: Executable code extraction",
  26. "Details":
  27.  
  28.  
  29. "Description": "Attempts to connect to a dead IP:Port (1 unique times)",
  30. "Details":
  31.  
  32. "IP_ioc": "13.107.4.50:80"
  33.  
  34.  
  35.  
  36.  
  37. "Description": "Creates RWX memory",
  38. "Details":
  39.  
  40.  
  41. "Description": "A process attempted to delay the analysis task.",
  42. "Details":
  43.  
  44. "Process": "Av3q1e2VNYN1.exe tried to sleep 308 seconds, actually delayed analysis time by 0 seconds"
  45.  
  46.  
  47.  
  48.  
  49. "Description": "The binary likely contains encrypted or compressed data.",
  50. "Details":
  51.  
  52. "section": "name: |VT9T, entropy: 7.93, characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE, raw_size: 0x00021000, virtual_size: 0x000205f7"
  53.  
  54.  
  55.  
  56.  
  57. "Description": "Collects information about installed applications",
  58. "Details":
  59.  
  60. "Program": "Microsoft Office Shared 64-bit MUI 2013"
  61.  
  62.  
  63. "Program": "Google Update Helper"
  64.  
  65.  
  66.  
  67.  
  68. "Program": "Microsoft Excel MUI 2013"
  69.  
  70.  
  71. "Program": "Microsoft Outlook MUI 2013"
  72.  
  73.  
  74.  
  75.  
  76. "Program": "Google Chrome"
  77.  
  78.  
  79.  
  80.  
  81. "Program": "Notepad++"
  82.  
  83.  
  84. "Program": "Microsoft Office Proofing Tools 2013 - Espa\\xc3\\xb1ol"
  85.  
  86.  
  87. "Program": "Adobe Flash Player 29 ActiveX"
  88.  
  89.  
  90.  
  91.  
  92. "Program": "Microsoft Access MUI 2013"
  93.  
  94.  
  95. "Program": "Microsoft Office 64-bit Components 2013"
  96.  
  97.  
  98. "Program": "Microsoft Office Proofing Tools 2013 - English"
  99.  
  100.  
  101. "Program": "Adobe Flash Player 29 NPAPI"
  102.  
  103.  
  104. "Program": "Adobe Acrobat Reader DC"
  105.  
  106.  
  107. "Program": "Adobe Refresh Manager"
  108.  
  109.  
  110. "Program": "Microsoft Publisher MUI 2013"
  111.  
  112.  
  113. "Program": "Microsoft DCF MUI 2013"
  114.  
  115.  
  116.  
  117.  
  118. "Program": "Microsoft Office Shared MUI 2013"
  119.  
  120.  
  121. "Program": "Microsoft Office OSM MUI 2013"
  122.  
  123.  
  124. "Program": "Microsoft InfoPath MUI 2013"
  125.  
  126.  
  127. "Program": "Microsoft Office Shared Setup Metadata MUI 2013"
  128.  
  129.  
  130. "Program": "Outils de v\\xc3\\xa9rification linguistique 2013 de Microsoft Office\\xc2\\xa0- Fran\\xc3\\xa7ais"
  131.  
  132.  
  133. "Program": "Microsoft Word MUI 2013"
  134.  
  135.  
  136.  
  137.  
  138.  
  139.  
  140.  
  141.  
  142. "Program": "Microsoft Groove MUI 2013"
  143.  
  144.  
  145. "Program": "Oracle VM VirtualBox Guest Additions 6.0.2"
  146.  
  147.  
  148.  
  149.  
  150.  
  151.  
  152. "Program": "Microsoft Office Shared 64-bit Setup Metadata MUI 2013"
  153.  
  154.  
  155. "Program": "Microsoft Access Setup Metadata MUI 2013"
  156.  
  157.  
  158. "Program": "Microsoft Office OSM UX MUI 2013"
  159.  
  160.  
  161. "Program": "Java Auto Updater"
  162.  
  163.  
  164. "Program": "Microsoft PowerPoint MUI 2013"
  165.  
  166.  
  167. "Program": "Microsoft Office Professional Plus 2013"
  168.  
  169.  
  170. "Program": "Java 8 Update 201"
  171.  
  172.  
  173. "Program": "Microsoft Office Proofing 2013"
  174.  
  175.  
  176. "Program": "Microsoft Lync MUI 2013"
  177.  
  178.  
  179.  
  180.  
  181.  
  182.  
  183. "Program": "Microsoft OneNote MUI 2013"
  184.  
  185.  
  186.  
  187.  
  188. "Description": "File has been identified by 20 Antiviruses on VirusTotal as malicious",
  189. "Details":
  190.  
  191. "FireEye": "Generic.mg.4008dc3b2fca0857"
  192.  
  193.  
  194. "K7AntiVirus": "Trojan ( 00549d461 )"
  195.  
  196.  
  197. "K7GW": "Trojan ( 00549d461 )"
  198.  
  199.  
  200. "Cybereason": "malicious.12b9ee"
  201.  
  202.  
  203. "Symantec": "Trojan.Emotet"
  204.  
  205.  
  206. "APEX": "Malicious"
  207.  
  208.  
  209. "Kaspersky": "UDS:DangerousObject.Multi.Generic"
  210.  
  211.  
  212. "Invincea": "heuristic"
  213.  
  214.  
  215. "SentinelOne": "DFI - Malicious PE"
  216.  
  217.  
  218. "Webroot": "W32.Trojan.Emotet"
  219.  
  220.  
  221. "Microsoft": "Trojan:Win32/Casur.A!cl"
  222.  
  223.  
  224. "Endgame": "malicious (high confidence)"
  225.  
  226.  
  227. "ZoneAlarm": "UDS:DangerousObject.Multi.Generic"
  228.  
  229.  
  230. "Acronis": "suspicious"
  231.  
  232.  
  233. "VBA32": "TScope.Malware-Cryptor.SB"
  234.  
  235.  
  236. "Cylance": "Unsafe"
  237.  
  238.  
  239. "ESET-NOD32": "a variant of Win32/Kryptik.GWDI"
  240.  
  241.  
  242. "Rising": "Trojan.Generic@ML.83 (RDML:rB7vcbrOQAQX6dJF7KVLpQ)"
  243.  
  244.  
  245. "CrowdStrike": "win/malicious_confidence_100% (D)"
  246.  
  247.  
  248. "Qihoo-360": "HEUR/QVM20.1.A50F.Malware.Gen"
  249.  
  250.  
  251.  
  252.  
  253. "Description": "Detects VirtualBox through the presence of a registry key",
  254. "Details":
  255.  
  256.  
  257. "Description": "Created network traffic indicative of malicious activity",
  258. "Details":
  259.  
  260. "signature": "ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)"
  261.  
  262.  
  263.  
  264.  
  265.  
  266. * Started Service:
  267.  
  268. * Mutexes:
  269. "DBWinMutex"
  270.  
  271.  
  272. * Modified Files:
  273. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\94308059B57B3142E455B38A6EB92015",
  274. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\94308059B57B3142E455B38A6EB92015"
  275.  
  276.  
  277. * Deleted Files:
  278.  
  279. * Modified Registry Keys:
  280.  
  281. * Deleted Registry Keys:
  282.  
  283. * DNS Communications:
  284.  
  285. * Domains:
  286.  
  287. * Network Communication - ICMP:
  288.  
  289. * Network Communication - HTTP:
  290.  
  291. * Network Communication - SMTP:
  292.  
  293. * Network Communication - Hosts:
  294.  
  295. "country_name": "United States",
  296. "ip": "198.61.168.254",
  297. "inaddrarpa": "",
  298. "hostname": ""
  299.  
  300.  
  301. "country_name": "United States",
  302. "ip": "198.199.106.229",
  303. "inaddrarpa": "",
  304. "hostname": ""
  305.  
  306.  
  307.  
  308. * Network Communication - IRC:
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement