MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 41aceca0bb988c74c9320155126761b98d50c6e556a684070c8e3f3822464229. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Dridex


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 41aceca0bb988c74c9320155126761b98d50c6e556a684070c8e3f3822464229
SHA3-384 hash: 7bf18b25f63985be4bfe31704ad47d4408b8bcf9ea85e7c95b7ff150c8a8c531a1ea0a345e4b14500fe6c7bd1a4ef351
SHA1 hash: 4a8487bcb011498c171fe995e89ed3f9a557c48c
MD5 hash: c88d35949162b88018c7cc918e483c9a
humanhash: lion-alanine-mississippi-mike
File name:c88d3594_by_Libranalysis
Download: download sample
Signature Dridex
Create hunting rule
File size:164'864 bytes
First seen:2021-05-05 22:02:13 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash bdaa0be01ce9860d02cb3111f632adfa (146 x Dridex)
ssdeep 3072:3f4Dcp/qdOUKcT1GpvO0nygcp0DvA/fxHbeXaUDwOvHvWM:gDBdOlG0nyg1DvwxgZ/v
Threatray 19 similar samples on MalwareBazaar
TLSH F5F3CFE89A9FC097E663583055FF37B6BA03D8478BC8DD10B281D52F5A1BD39DD09A01
Reporter Libranalysis
Tags:Dridex


Avatar
Libranalysis
Uploaded as part of the sample sharing project

Intelligence

File Origin
# of uploads :
1
# of downloads :
56
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/150800/
Detection(s):
SecuriteInfo.com.Mal.EncPk-APX.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Sending a UDP request
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/41aceca0bb988c74c9320155126761b98d50c6e556a684070c8e3f3822464229/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2021-05-05 22:03:08 UTC
AV detection:
16 of 47 (34.04%)
Threat level:
  5/5
Verdict:
unknown
Similar samples:
16b4fe51c3f1af8bcc3257e3b1e81433fdcac08e61bdefc95b5b10fb7a7bd74e
Dridex
17aeb7372b57d7559a6f507074fe1da973a104a2de8b0d8e229bfc4515c6d015
Dridex
1b3db260f69f51fd02533da364f56a4825e5ac0777ffc1fb68d54ce17662191e
Dridex
2ba11191a9da3d155b82d848577ee0b7eed0a90f86091d187bc157dd252a3d44
Dridex
4ec406d75588c4e395c1a5b93bf43da319684352061cf42876c704d92a52df92
Dridex
72306c6457c918bfaa19009cc21ae5eaf4bfad936e8694482c719f6f1c0c0266
Dridex
764f41b29285d1ad19f7bc5f0ad5d34255951cda7e24462e80bfe45847dbd545
Dridex
97d62d9cba3d8219f27c42650eb90fd3ee8aa4c7f478c76e30f88f11dd5e1a82
Dridex
9ff01c0edcf9082323a22fc225b4f2f7c9ff6d5b1f7c8d76c94da83b4c37ec25
Dridex
b4da172dbfd3b40190692e10006a83cb0e125c7fde11574e68fd04ff3b92f816
Dridex
+ 9 additional samples on MalwareBazaar
Result
Malware family:
dridex
Create hunting rule
Score:
  10/10
Tags:
family:dridex botnet:22202 botnet loader
Link:
https://tria.ge/reports/210505-k7htfa3fwe/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Dridex Loader
Dridex
Malware Config
C2 Extraction:
45.55.134.126:443
67.207.83.96:8172
193.160.214.95:4125
Unpacked files
SH256 hash:
41aceca0bb988c74c9320155126761b98d50c6e556a684070c8e3f3822464229
MD5 hash:
c88d35949162b88018c7cc918e483c9a
SHA1 hash:
4a8487bcb011498c171fe995e89ed3f9a557c48c
Link:
https://www.unpac.me/results/f9efbc5c-4e07-41c6-a48f-5a51ae24e04b/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.14
Link:
https://yomi.yoroi.company/submissions/41aceca0bb988c74c9320155126761b98d50c6e556a684070c8e3f3822464229

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/150800/

Comments