MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 40425542abe4fe6fe4c8fd55571bdb0b1d60cc2b2cd859bcb51a1ebfc5e76e3f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Dridex

Vendor detections: 4

Intelligence 4 IOCs YARA File information Comments 1

SHA256 hash:	40425542abe4fe6fe4c8fd55571bdb0b1d60cc2b2cd859bcb51a1ebfc5e76e3f
SHA3-384 hash:	1736111369382b954fc4a5a7ea88a10735f643de16935a2cecb0705ba8f35fba71f4cb09bab1117f9fac35ddc5383929
SHA1 hash:	9c0fde15c30624f56ebb69aedd3c9022483d4456
MD5 hash:	3b460a87251a91e10d7fa834b9e050c7
humanhash:	snake-blue-minnesota-louisiana
File name:	3b460a87_by_Libranalysis
Download:	download sample
Signature	Dridex Create hunting rule
File size:	164'864 bytes
First seen:	2021-05-05 22:10:20 UTC
Last seen:	Never
File type:	dll
MIME type:	application/x-dosexec
imphash	bdaa0be01ce9860d02cb3111f632adfa (146 x Dridex)
ssdeep	3072:dW4Dcp/qdOUKcT1GpvO0nygcp0DvA/fxHbeXaUDwOvHvWM:TDBdOlG0nyg1DvwxgZ/v
Threatray	63 similar samples on MalwareBazaar
TLSH	81F3CFE89A9FC097E663583095FF37B6BA03D8478BC8DD10B281D52F5A1BD39DD09A01
Reporter	Libranalysis
Tags:	Dridex

Libranalysis

Uploaded as part of the sample sharing project

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/150946/

Detection(s):

SecuriteInfo.com.Mal.EncPk-APX.UNOFFICIAL

Result

Verdict:

Clean

Maliciousness:

Behaviour

Sending a UDP request

Result

Verdict:

UNKNOWN

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/40425542abe4fe6fe4c8fd55571bdb0b1d60cc2b2cd859bcb51a1ebfc5e76e3f/

Threat name:

Win32.Trojan.Wacatac

Status:

Malicious

First seen:

2021-05-05 22:10:40 UTC

AV detection:

15 of 46 (32.61%)

Threat level:

5/5

Result

Malware family:

dridex

Score:

10/10

Tags:

family:dridex botnet:22202 botnet loader

Link:

https://tria.ge/reports/210505-2xdftqj48s/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Program crash

Dridex Loader

Dridex

Malware Config

C2 Extraction:

45.55.134.126:443
67.207.83.96:8172
193.160.214.95:4125

Unpacked files

SH256 hash:

40425542abe4fe6fe4c8fd55571bdb0b1d60cc2b2cd859bcb51a1ebfc5e76e3f

MD5 hash:

3b460a87251a91e10d7fa834b9e050c7

SHA1 hash:

9c0fde15c30624f56ebb69aedd3c9022483d4456

Link:

https://www.unpac.me/results/d195b30f-0b02-42f6-8d08-d5325c2e137f/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/40425542abe4fe6fe4c8fd55571bdb0b1d60cc2b2cd859bcb51a1ebfc5e76e3f

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/150946/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

a̵c̵c̸i̵d̷e̵n̷t̴a̷l̴r̵e̷b̸e̴l̸ commented on 2021-05-05 23:17:56 UTC

============================================================
MBC behaviors list (github.com/accidentalrebel/mbcscan):
============================================================
0) [B0001.025] Anti-Behavioral Analysis::Software Breakpoints
1) [B0009] Anti-Behavioral Analysis::Virtual Machine Detection