Advertisement
paladin316

864Dridex_4008dc3b2fca085762c9b8d9ca06fcc3_bin_2019-09-03_20_30.txt

Sep 3rd, 2019
1,540
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 7.78 KB | None | 0 0
  1.  
  2. * ID: 864
  3. * MalFamily: "Malicious"
  4.  
  5. * MalScore: 10.0
  6.  
  7. * File Name: "Dridex_4008dc3b2fca085762c9b8d9ca06fcc3.bin"
  8. * File Size: 352256
  9. * File Type: "PE32 executable (GUI) Intel 80386, for MS Windows"
  10. * SHA256: "77617cff003e8d9d9d98493d88b75de683d447d0360a0b390e429b14f75cf30e"
  11. * MD5: "4008dc3b2fca085762c9b8d9ca06fcc3"
  12. * SHA1: "bd0420512b9ee3a0cbaf0e40b6f0522aba15812a"
  13. * SHA512: "6a12ce1ccd4e90e9ec49364a395da9777bc61f0efffca543a264c659eca709e5dbced7f392ee4cd3bb67042ddbb064e39c8e28b144e87a100a38201506d60eb8"
  14. * CRC32: "53859DA9"
  15. * SSDEEP: "6144:XKf7YBW60YdeOAGnnKEY9XBK7g39xNDaYScur6bbvjZr:XKIWDY0OAixY9X4itDarju"
  16.  
  17. * Process Execution:
  18. "XdaIfYwn.exe"
  19.  
  20.  
  21. * Executed Commands:
  22.  
  23. * Signatures Detected:
  24.  
  25. "Description": "Behavioural detection: Executable code extraction",
  26. "Details":
  27.  
  28.  
  29. "Description": "Attempts to connect to a dead IP:Port (1 unique times)",
  30. "Details":
  31.  
  32. "IP_ioc": "205.185.216.42:80"
  33.  
  34.  
  35.  
  36.  
  37. "Description": "A process attempted to delay the analysis task.",
  38. "Details":
  39.  
  40. "Process": "XdaIfYwn.exe tried to sleep 274 seconds, actually delayed analysis time by 0 seconds"
  41.  
  42.  
  43.  
  44.  
  45. "Description": "The binary likely contains encrypted or compressed data.",
  46. "Details":
  47.  
  48. "section": "name: |VT9T, entropy: 7.93, characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE, raw_size: 0x00021000, virtual_size: 0x000205f7"
  49.  
  50.  
  51.  
  52.  
  53. "Description": "Collects information about installed applications",
  54. "Details":
  55.  
  56. "Program": "Microsoft Office Shared 64-bit MUI 2013"
  57.  
  58.  
  59. "Program": "Google Update Helper"
  60.  
  61.  
  62.  
  63.  
  64. "Program": "Microsoft Excel MUI 2013"
  65.  
  66.  
  67. "Program": "Microsoft Outlook MUI 2013"
  68.  
  69.  
  70.  
  71.  
  72. "Program": "Google Chrome"
  73.  
  74.  
  75.  
  76.  
  77. "Program": "Notepad++"
  78.  
  79.  
  80. "Program": "Microsoft Office Proofing Tools 2013 - Espa\\xc3\\xb1ol"
  81.  
  82.  
  83. "Program": "Adobe Flash Player 29 ActiveX"
  84.  
  85.  
  86.  
  87.  
  88. "Program": "Microsoft Access MUI 2013"
  89.  
  90.  
  91. "Program": "Microsoft Office 64-bit Components 2013"
  92.  
  93.  
  94. "Program": "Microsoft Office Proofing Tools 2013 - English"
  95.  
  96.  
  97. "Program": "Adobe Flash Player 29 NPAPI"
  98.  
  99.  
  100. "Program": "Adobe Acrobat Reader DC"
  101.  
  102.  
  103. "Program": "Adobe Refresh Manager"
  104.  
  105.  
  106. "Program": "Microsoft Publisher MUI 2013"
  107.  
  108.  
  109. "Program": "Microsoft DCF MUI 2013"
  110.  
  111.  
  112.  
  113.  
  114. "Program": "Microsoft Office Shared MUI 2013"
  115.  
  116.  
  117. "Program": "Microsoft Office OSM MUI 2013"
  118.  
  119.  
  120. "Program": "Microsoft InfoPath MUI 2013"
  121.  
  122.  
  123. "Program": "Microsoft Office Shared Setup Metadata MUI 2013"
  124.  
  125.  
  126. "Program": "Outils de v\\xc3\\xa9rification linguistique 2013 de Microsoft Office\\xc2\\xa0- Fran\\xc3\\xa7ais"
  127.  
  128.  
  129. "Program": "Microsoft Word MUI 2013"
  130.  
  131.  
  132.  
  133.  
  134.  
  135.  
  136.  
  137.  
  138. "Program": "Microsoft Groove MUI 2013"
  139.  
  140.  
  141. "Program": "Oracle VM VirtualBox Guest Additions 6.0.2"
  142.  
  143.  
  144.  
  145.  
  146.  
  147.  
  148. "Program": "Microsoft Office Shared 64-bit Setup Metadata MUI 2013"
  149.  
  150.  
  151. "Program": "Microsoft Access Setup Metadata MUI 2013"
  152.  
  153.  
  154. "Program": "Microsoft Office OSM UX MUI 2013"
  155.  
  156.  
  157. "Program": "Java Auto Updater"
  158.  
  159.  
  160. "Program": "Microsoft PowerPoint MUI 2013"
  161.  
  162.  
  163. "Program": "Microsoft Office Professional Plus 2013"
  164.  
  165.  
  166. "Program": "Java 8 Update 201"
  167.  
  168.  
  169. "Program": "Microsoft Office Proofing 2013"
  170.  
  171.  
  172. "Program": "Microsoft Lync MUI 2013"
  173.  
  174.  
  175.  
  176.  
  177.  
  178.  
  179. "Program": "Microsoft OneNote MUI 2013"
  180.  
  181.  
  182.  
  183.  
  184. "Description": "File has been identified by 20 Antiviruses on VirusTotal as malicious",
  185. "Details":
  186.  
  187. "FireEye": "Generic.mg.4008dc3b2fca0857"
  188.  
  189.  
  190. "K7AntiVirus": "Trojan ( 00549d461 )"
  191.  
  192.  
  193. "K7GW": "Trojan ( 00549d461 )"
  194.  
  195.  
  196. "Cybereason": "malicious.12b9ee"
  197.  
  198.  
  199. "Symantec": "Trojan.Emotet"
  200.  
  201.  
  202. "APEX": "Malicious"
  203.  
  204.  
  205. "Kaspersky": "UDS:DangerousObject.Multi.Generic"
  206.  
  207.  
  208. "Invincea": "heuristic"
  209.  
  210.  
  211. "SentinelOne": "DFI - Malicious PE"
  212.  
  213.  
  214. "Webroot": "W32.Trojan.Emotet"
  215.  
  216.  
  217. "Microsoft": "Trojan:Win32/Casur.A!cl"
  218.  
  219.  
  220. "Endgame": "malicious (high confidence)"
  221.  
  222.  
  223. "ZoneAlarm": "UDS:DangerousObject.Multi.Generic"
  224.  
  225.  
  226. "Acronis": "suspicious"
  227.  
  228.  
  229. "VBA32": "TScope.Malware-Cryptor.SB"
  230.  
  231.  
  232. "Cylance": "Unsafe"
  233.  
  234.  
  235. "ESET-NOD32": "a variant of Win32/Kryptik.GWDI"
  236.  
  237.  
  238. "Rising": "Trojan.Generic@ML.83 (RDML:rB7vcbrOQAQX6dJF7KVLpQ)"
  239.  
  240.  
  241. "CrowdStrike": "win/malicious_confidence_100% (D)"
  242.  
  243.  
  244. "Qihoo-360": "HEUR/QVM20.1.A50F.Malware.Gen"
  245.  
  246.  
  247.  
  248.  
  249. "Description": "Detects VirtualBox through the presence of a registry key",
  250. "Details":
  251.  
  252.  
  253. "Description": "Created network traffic indicative of malicious activity",
  254. "Details":
  255.  
  256. "signature": "ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)"
  257.  
  258.  
  259.  
  260.  
  261.  
  262. * Started Service:
  263.  
  264. * Mutexes:
  265. "DBWinMutex"
  266.  
  267.  
  268. * Modified Files:
  269. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\94308059B57B3142E455B38A6EB92015",
  270. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\94308059B57B3142E455B38A6EB92015"
  271.  
  272.  
  273. * Deleted Files:
  274.  
  275. * Modified Registry Keys:
  276.  
  277. * Deleted Registry Keys:
  278.  
  279. * DNS Communications:
  280.  
  281. * Domains:
  282.  
  283. * Network Communication - ICMP:
  284.  
  285. * Network Communication - HTTP:
  286.  
  287. * Network Communication - SMTP:
  288.  
  289. * Network Communication - Hosts:
  290.  
  291. "country_name": "United States",
  292. "ip": "198.61.168.254",
  293. "inaddrarpa": "",
  294. "hostname": ""
  295.  
  296.  
  297. "country_name": "United States",
  298. "ip": "198.199.106.229",
  299. "inaddrarpa": "",
  300. "hostname": ""
  301.  
  302.  
  303.  
  304. * Network Communication - IRC:
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement