MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 604eeb3266ad164ea1a0ab9e489b7b4831149accf718a8b98fb587de2305e1cb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Dridex


Vendor detections: 4


Intelligence 4 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 604eeb3266ad164ea1a0ab9e489b7b4831149accf718a8b98fb587de2305e1cb
SHA3-384 hash: dc329ce283858769069f40e6ffa2b97c0ca7e5948596710891b7eb59367647538f4aad24f15a87b6af8930d62ee640cd
SHA1 hash: 671157126b67d0dcf6db70683a1a8e9af9ada7b6
MD5 hash: 09afc5278da48aa2035ba08892a8f9f2
humanhash: indigo-steak-mississippi-kansas
File name:09afc527_by_Libranalysis
Download: download sample
Signature Dridex
Create hunting rule
File size:164'864 bytes
First seen:2021-05-05 22:05:34 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash bdaa0be01ce9860d02cb3111f632adfa (146 x Dridex)
ssdeep 3072:RK4Dcp/qdOUKcT1GpvO0nygcp0DvA/fxHbeXaUDwOvHvWM:7DBdOlG0nyg1DvwxgZ/v
Threatray 85 similar samples on MalwareBazaar
TLSH 13F3CFE89A9FC097E663583055FF37B6BA03D8478BC8DD10B281D52F5A1BD39DD09A01
Reporter Libranalysis
Tags:Dridex


Avatar
Libranalysis
Uploaded as part of the sample sharing project

Intelligence

File Origin
# of uploads :
1
# of downloads :
57
Origin country :
n/a
Vendor Threat Intelligence
Detection:
DridexLoader
Create hunting rule
Link:
https://www.capesandbox.com/analysis/150861/
Detection(s):
SecuriteInfo.com.Mal.EncPk-APX.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Sending a custom TCP request
Sending a UDP request
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/604eeb3266ad164ea1a0ab9e489b7b4831149accf718a8b98fb587de2305e1cb/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2021-05-05 22:06:12 UTC
AV detection:
16 of 47 (34.04%)
Threat level:
  5/5
Verdict:
unknown
Similar samples:
16b4fe51c3f1af8bcc3257e3b1e81433fdcac08e61bdefc95b5b10fb7a7bd74e
Dridex
17aeb7372b57d7559a6f507074fe1da973a104a2de8b0d8e229bfc4515c6d015
Dridex
1b3db260f69f51fd02533da364f56a4825e5ac0777ffc1fb68d54ce17662191e
Dridex
2ba11191a9da3d155b82d848577ee0b7eed0a90f86091d187bc157dd252a3d44
Dridex
41aceca0bb988c74c9320155126761b98d50c6e556a684070c8e3f3822464229
Dridex
4ec406d75588c4e395c1a5b93bf43da319684352061cf42876c704d92a52df92
Dridex
72306c6457c918bfaa19009cc21ae5eaf4bfad936e8694482c719f6f1c0c0266
Dridex
764f41b29285d1ad19f7bc5f0ad5d34255951cda7e24462e80bfe45847dbd545
Dridex
97d62d9cba3d8219f27c42650eb90fd3ee8aa4c7f478c76e30f88f11dd5e1a82
Dridex
9ff01c0edcf9082323a22fc225b4f2f7c9ff6d5b1f7c8d76c94da83b4c37ec25
Dridex
+ 75 additional samples on MalwareBazaar
Result
Malware family:
dridex
Create hunting rule
Score:
  10/10
Tags:
family:dridex botnet:22202 botnet loader
Link:
https://tria.ge/reports/210505-a3dbpdb7bs/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Dridex Loader
Dridex
Malware Config
C2 Extraction:
45.55.134.126:443
67.207.83.96:8172
193.160.214.95:4125
Unpacked files
SH256 hash:
604eeb3266ad164ea1a0ab9e489b7b4831149accf718a8b98fb587de2305e1cb
MD5 hash:
09afc5278da48aa2035ba08892a8f9f2
SHA1 hash:
671157126b67d0dcf6db70683a1a8e9af9ada7b6
Link:
https://www.unpac.me/results/c60c62e7-7382-43b4-a2a2-877d8e91136e/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.14
Link:
https://yomi.yoroi.company/submissions/604eeb3266ad164ea1a0ab9e489b7b4831149accf718a8b98fb587de2305e1cb

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DridexLoader
Create hunting rule
Author:kevoreilly
Description:Dridex v4 dropper C2 parsing function
Rule name:DridexV4
Create hunting rule
Author:kevoreilly
Description:Dridex v4 Payload
Rule name:MALWARE_Win_DLLLoader
Create hunting rule
Author:ditekSHen
Description:Detects unknown DLL Loader

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/150861/

Comments