MALICIOUS — b08c10362022ecc692b1cbf5064d3796701863e6e77b92cf8b4dd119b1642ebb
MALICIOUS — b08c10362022ecc692b1cbf5064d3796701863e6e77b92cf8b4dd119b1642ebb is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the DridexLoader family. 5 of 56 detection engines flagged it.
Identification
- SHA-256:
b08c10362022ecc692b1cbf5064d3796701863e6e77b92cf8b4dd119b1642ebb - SHA-1:
57b13724526e4b7cca85c781bec631651cad0b1b - MD5:
cc37a16740e829f44f892f6c78969c8f - imphash:
523226cba44b4d4081c59acfc5571447 - ssdeep:
6144:MfCsqfbmflaf/wfF2fBcknm7PmH/A5VmrFwvKHn8odiVMtZzHtsypRCftXkeGh0:2jq42uvGzdimbTtbpuq - TLSH:
T1B64ABF76D6802485C3D1F791E50A485C92BDB83F1F5623E0678E55E0261AE8336FE3A3 - Submitted as: b08c10362022ecc692b1cbf5064d3796701863e6e77b92cf8b4dd119b1642ebb
- File type: pe · Size: 442368 bytes
- Verdict: malicious (100/100) · Family: DridexLoader
Detections (5 of 56 engines)
- ClamAV (daily): Win.Dropper.Drixed-9908198-0
- Microsoft Defender: Trojan:Win32/Dridex.CE!MTB
- Emsisoft (Emergency Kit): Gen:Variant.Razy.986579
- Trellix Stinger (McAfee): Drixed-FJX!CC37A16740E8
- Kaspersky (KVRT): Trojan-Downloader.Win32.Cridex.pfb
Why this verdict
The malicious score of 100/100 is the fusion of 7 weighted signals:
- ClamAV (daily) flagged Win.Dropper.Drixed-9908198-0 (rule
Win.Dropper.Drixed-9908198-0) - engine signal, weight 0.90, confidence 0.95 - Extracted DridexLoader config (1 C2) - engine signal, weight 0.80, confidence 0.90
- Microsoft Defender flagged Trojan:Win32/Dridex.CE!MTB (rule
Trojan:Win32/Dridex.CE!MTB) - engine signal, weight 0.55, confidence 0.85 - Emsisoft (Emergency Kit) flagged Gen:Variant.Razy.986579 (rule
Gen:Variant.Razy.986579) - engine signal, weight 0.55, confidence 0.85 - Trellix Stinger (McAfee) flagged Drixed-FJX!CC37A16740E8 (rule
Drixed-FJX!CC37A16740E8) - engine signal, weight 0.55, confidence 0.85 - Kaspersky (KVRT) flagged Trojan-Downloader.Win32.Cridex.pfb (rule
Trojan-Downloader.Win32.Cridex.pfb) - engine signal, weight 0.55, confidence 0.85 - Contacted 6 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Dynamic analysis (windows)
100 behavior events · 0 ATT&CK techniques · 1 dropped files.
Runtime network
- www.msftconnecttest.com
- rb.symcd.com
- rb.symcb.com
- inference.location.live.net
- ctldl.windowsupdate.com
- update.googleapis.com
- login.live.com
- desktop-hsgcbep
- v20.events.data.microsoft.com
- config.edge.skype.com
- windows.msn.com
- officeclient.microsoft.com
- www.msn.com
- odc.officeapps.live.com
- settings-win.data.microsoft.com
- assets.msn.com
- www.bing.com
- licensing.mp.microsoft.com
- fe3cr.delivery.mp.microsoft.com
- v10.events.data.microsoft.com
Dropped files
- a376b95f95d8edc2aab740fd15f2723f6c3388258241d5fc790116c4b927ec40 -
a376b95f95d8edc2aab740fd15f2723f6c3388258241d5fc790116c4b927ec40
Embedded URLs
- http://www.msftconnecttest.com/connecttest.txt
- http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
- http://rb.symcb.com/rb.crl
Embedded IP addresses
- 13.69.239.69
- 4.230.171.124
- 20.42.179.192
- 20.247.184.142
- 135.232.92.97
- 20.165.94.63
- 20.42.65.90
- 20.184.175.3
- 74.178.76.128
- 162.159.142.9
- 135.233.45.223
- 72.154.7.110
- 52.148.114.188
- 52.110.12.47
- 52.110.12.15
File paths
- X:\:d:h:l:p:t:x:
- X:\:`:d:h:l:
More DridexLoader samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report