MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 10da9cfc721819a55d159253469b7a88c803241d8eda417854d5348bbaf12d60. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Intelligence File information Yara Comments

SHA256 hash: 10da9cfc721819a55d159253469b7a88c803241d8eda417854d5348bbaf12d60
SHA3-384 hash: dd67bfe0faa0b29f454b3818e2388bc2b193754e674fedf9ab01a717c9159835ef09b9e06541d660e64e0f6377c556dc
SHA1 hash: d34ff4e2491da20f2a982fa73d0d6ab9e2102b0b
MD5 hash: d36d308b43b5451c72203b2e0c99d9b0
humanhash: london-oranges-november-east
File name:tasks_188.vir
Download: download sample
Signature Dridex
File size:232'166 bytes
First seen:2020-07-19 17:20:46 UTC
Last seen:2020-07-19 19:15:22 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 132bdcf0b93686d584a3ebb4c62bad21
ssdeep 6144:i/mvTF5ANS4gHJwgWEQqRH3Bo7G4aKUSYgxSoiFrXhi9o:CIB5KS4gHJwwRxiLxyRl
TLSH 0B3412F0B99BA59BD5476F300A465F580EF6B6361BB8956B80C0975E4020F88DEA3F34
Reporter @tildedennis
Tags:Dridex tasks


Twitter
@tildedennis
tasks version 188

Intelligence


File Origin
# of uploads :
2
# of downloads :
60
Origin country :
US US
Mail intelligence
No data
Vendor Threat Intelligence
Gathering data
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Unauthorized injection to a recently created process
Connection attempt to an infection source
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
64 / 100
Behaviour
Behavior Graph:
Threat name:
Win32.Trojan.Kazy
Status:
Malicious
First seen:
2013-05-07 09:42:00 UTC
AV detection:
21 of 25 (84.00%)
Threat level
  5/5
Result
Malware family:
n/a
Score:
  8/10
Tags:
persistence
Behaviour
Suspicious use of SetWindowsHookEx
Suspicious use of FindShellTrayWindow
Modifies system certificate store
Suspicious use of WriteProcessMemory
Suspicious behavior: EnumeratesProcesses
Suspicious use of SendNotifyMessage
Modifies Internet Explorer settings
Suspicious use of WriteProcessMemory
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Drops file in Windows directory
Drops file in Windows directory
Drops file in System32 directory
Drops file in System32 directory
Checks whether UAC is enabled
Adds Run key to start application
Adds Run key to start application
Deletes itself
Loads dropped DLL
Executes dropped EXE
Executes dropped EXE
Threat name:
Unknown
Score:
1.00

File information


The table below shows additional information about this malware sample such as delivery method and external references.

Comments