MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 16b98e2156fb721a760cd3d4e5c1a8c18dee54f795c6d8624339e25c5e33c2b1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Dridex

Vendor detections: 6

Intelligence 6 IOCs YARA 1 File information Comments

SHA256 hash:	16b98e2156fb721a760cd3d4e5c1a8c18dee54f795c6d8624339e25c5e33c2b1
SHA3-384 hash:	9789a11c7b19f38275b8336e24af4442b422410c262f43ad868a46059e7a60170c00b023fe7730e629d6b00b5ae10258
SHA1 hash:	4e3ff8b1fc956090be01b2f367041d29316a6a1e
MD5 hash:	98878d4f648ee9936b18706b74ef466d
humanhash:	sierra-december-cold-ten
File name:	930324.xls
Download:	download sample
Signature	Dridex Create hunting rule
File size:	356'352 bytes
First seen:	2020-07-21 11:51:36 UTC
Last seen:	2020-07-21 12:54:54 UTC
File type:	xls
MIME type:	application/vnd.ms-excel
ssdeep	6144:9luefinndGD7WfPjOwjsEm44tahI53APKLYQwXHOntKUScTbTOMMt92/vFT+4O+:9lJfinTPjOtMPpQwXODiMMt9gTd9
TLSH	0A7423267A7B832BC3BF7A7D456A84285BA2DD02C34B59626BC7370C1677F421C17C62
Reporter	abuse_ch
Tags:	Dridex xls

abuse_ch

Malspam distributing Dridex:

HELO: aravali.serverforhost.com
Sending IP: 103.133.215.101
From: Colene Monah <info@gayatrienterprises.net>
Reply-To: carolyn@loncherie.com
Subject: RE: Invoice Due #157973
Attachment: 930324.xls

Dridex payload URL:
http://secretpath.xyz/japele.exe

Botnet ID: 40400
Dridex C2s:
51.38.124.206:443
207.180.230.218:3389
2.58.16.87:8443
45.177.120.36:691

Intelligence

File Origin

# of uploads :

# of downloads :

302

Origin country :

n/a

Vendor Threat Intelligence

Detection(s):

SecuriteInfo.com.XLM.Trojan.Abracadabra.1.Gen.16240.31440.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Creating a file in the %temp% directory

Launching the default Windows debugger (dwwin.exe)

Launching a process by exploiting the app vulnerability

Result

Threat name:

Hidden Macro 4.0

Detection:

malicious

Classification:

expl.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/393070

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/16b98e2156fb721a760cd3d4e5c1a8c18dee54f795c6d8624339e25c5e33c2b1/

Threat name:

Document-Office.Trojan.Abracadabra

Status:

Malicious

First seen:

2020-07-21 11:53:05 UTC

AV detection:

14 of 29 (48.28%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=c24y4ikw7nzbu5qm2pkolqniygg64vhxsxdnqysdhhrfyxrtykyq._file

Result

Malware family:

n/a

Score:

6/10

Tags:

n/a

Link:

https://tria.ge/reports/200721-hhrphh1142/

Behaviour

Suspicious use of WriteProcessMemory

Suspicious behavior: GetForegroundWindowSpam

Suspicious behavior: AddClipboardFormatListener

Suspicious use of SetWindowsHookEx

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Checks processor information in registry

Enumerates system info in registry

Suspicious use of SetWindowsHookEx

Suspicious behavior: AddClipboardFormatListener

Suspicious behavior: EnumeratesProcesses

Process spawned suspicious child process

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Unknown

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/16b98e2156fb721a760cd3d4e5c1a8c18dee54f795c6d8624339e25c5e33c2b1

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.