MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4160e31c01e1c9fbad1e737efb974a0cb35721023607e831292c26873bdee4db. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Dridex


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4160e31c01e1c9fbad1e737efb974a0cb35721023607e831292c26873bdee4db
SHA3-384 hash: 3147e23fe3e401d7cd2bc8e3fcdfa5af44c077fb98f82e7456a4bb105b0fa8eb2cae7162cf067151910f4ea94b9b4582
SHA1 hash: a634c4cc3c98d4f44a38035aa35b77db8e0150a2
MD5 hash: 05c1262465d48f0761f6741459c3fb26
humanhash: aspen-mountain-dakota-low
File name:okasle.exe
Download: download sample
Signature Dridex
Create hunting rule
File size:200'704 bytes
First seen:2020-07-02 14:58:08 UTC
Last seen:2020-07-02 15:16:21 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 138d7cf0cff2a37eaef02b9f85e3c81b (6 x Dridex)
ssdeep 6144:+qWuU/QvBeWgUCFWK9vL5ipw99NaML6Ez:ToQRQF7BcyvN8
Threatray 78 similar samples on MalwareBazaar
TLSH 9B140213362E60DDE22ABC70B11AEE1957006CA99559C647AA8E3FDB1C3BE815C21377
Reporter JAMESWT_WT
Tags:Dridex

Intelligence

File Origin
# of uploads :
2
# of downloads :
130
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Detection(s):
SecuriteInfo.com.Generic.mg.45dfa08a001e4827.1646.UNOFFICIAL
Create hunting rule

Detection:
dridex
Create hunting rule
Link:
https://mwdb.cert.pl/sample/4160e31c01e1c9fbad1e737efb974a0cb35721023607e831292c26873bdee4db/
Threat name:
Win32.Infostealer.Dridex
Create hunting rule
Status:
Malicious
First seen:
2020-07-02 15:00:07 UTC
File Type:
PE (Exe)
Extracted files:
2
AV detection:
24 of 29 (82.76%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ifqoghab4he7xli6on7pxf2kbszvoiicgyd6qmjjfqtioo664tnq._file
Verdict:
suspicious
Similar samples:
043da6ea28e1ae44078f4941c3e7db3c63566f4b312121bd3f81b6b3cec0e8d7
Dridex
0a3dcb013e94255746453eef065037b396b4174e080c3bf5a7fbf56e7ef76fbe
Dridex
4fae283ae2323e49f1a95871e773e3a2bfe54dc151cd7c11cbe41a36fd83bb14
Dridex
55897dc537d308842906dbf8bffde6eb846cdd6b5e9584d7efcbe7c342d5e699
Dridex
73542918c46a8a028d9a19169f5cb4fa09f3ea609085e3efd5324d07254d7280
Dridex
a84a6fde4dbc4575700b8be705ed1df6d576e5aa6054aa66f1fae98350484a84
Dridex
c4f35b00490a1875286701b5909053c04668e4ec09da8e4ecd7405a3c136d6b0
Dridex
cf62e1cdb2dd3f209c719e62340f61a69d442f3b391f43528c603c70ab18c8b6
Dridex
f072b971950ba8a2e12c85501f0d63160f833df8411c5fa1cda8ac6261b27a2d
Dridex
fcc0db0ce710f68915b4d73274d69bb5765012b02631bb737c66a32a9a708aab
Dridex
+ 68 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/200702-3s773x1yxj/
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Dridex

Executable exe 4160e31c01e1c9fbad1e737efb974a0cb35721023607e831292c26873bdee4db

(this sample)

  
Link
http://luyitaw.com/okasle.exe
  
URLhaus
https://urlhaus.abuse.ch/url/407081/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/18506/

Comments