MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8166266902f013780f118f0b4673cb4d0553a68d1bc124b13fe95492975f19fe. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Dridex


Vendor detections: 3


Intelligence 3 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8166266902f013780f118f0b4673cb4d0553a68d1bc124b13fe95492975f19fe
SHA3-384 hash: 3f459f095cc4f873dd81fa615cb99c981faf4d76b0e9309c8d90d2b282e8bb1eba2288f401eec4bb657b4d3cf521a218
SHA1 hash: 7a2935808afd5a491f3c5c312944ca08a78d0f3c
MD5 hash: 073aa7e82d973bfe5e5f65681a8b7ba5
humanhash: delaware-cold-delta-enemy
File name:073aa7e8_by_Libranalysis
Download: download sample
Signature Dridex
Create hunting rule
File size:164'864 bytes
First seen:2021-05-05 22:05:50 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash bdaa0be01ce9860d02cb3111f632adfa (146 x Dridex)
ssdeep 3072:Jv4Dcp/qdOUKcT1GpvO0nygcp0DvA/fxHbeXaUDwOvHvWM:GDBdOlG0nyg1DvwxgZ/v
Threatray 85 similar samples on MalwareBazaar
TLSH 5FF3CFE89A9FC097E663583055FF37B6BA03D8478BC8DD10B281D52F5A1BD39DD09A01
Reporter Libranalysis
Tags:Dridex


Avatar
Libranalysis
Uploaded as part of the sample sharing project

Intelligence

File Origin
# of uploads :
1
# of downloads :
57
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/150865/
Detection(s):
SecuriteInfo.com.Mal.EncPk-APX.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Sending a UDP request
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/8166266902f013780f118f0b4673cb4d0553a68d1bc124b13fe95492975f19fe/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2021-05-05 22:06:14 UTC
AV detection:
16 of 47 (34.04%)
Threat level:
  5/5
Verdict:
unknown
Similar samples:
16b4fe51c3f1af8bcc3257e3b1e81433fdcac08e61bdefc95b5b10fb7a7bd74e
Dridex
17aeb7372b57d7559a6f507074fe1da973a104a2de8b0d8e229bfc4515c6d015
Dridex
1b3db260f69f51fd02533da364f56a4825e5ac0777ffc1fb68d54ce17662191e
Dridex
2ba11191a9da3d155b82d848577ee0b7eed0a90f86091d187bc157dd252a3d44
Dridex
41aceca0bb988c74c9320155126761b98d50c6e556a684070c8e3f3822464229
Dridex
4ec406d75588c4e395c1a5b93bf43da319684352061cf42876c704d92a52df92
Dridex
72306c6457c918bfaa19009cc21ae5eaf4bfad936e8694482c719f6f1c0c0266
Dridex
764f41b29285d1ad19f7bc5f0ad5d34255951cda7e24462e80bfe45847dbd545
Dridex
97d62d9cba3d8219f27c42650eb90fd3ee8aa4c7f478c76e30f88f11dd5e1a82
Dridex
9ff01c0edcf9082323a22fc225b4f2f7c9ff6d5b1f7c8d76c94da83b4c37ec25
Dridex
+ 75 additional samples on MalwareBazaar
Result
Malware family:
dridex
Create hunting rule
Score:
  10/10
Tags:
family:dridex botnet:22202 botnet loader
Link:
https://tria.ge/reports/210505-5va37vve2x/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Dridex Loader
Dridex
Malware Config
C2 Extraction:
45.55.134.126:443
67.207.83.96:8172
193.160.214.95:4125
Unpacked files
SH256 hash:
8166266902f013780f118f0b4673cb4d0553a68d1bc124b13fe95492975f19fe
MD5 hash:
073aa7e82d973bfe5e5f65681a8b7ba5
SHA1 hash:
7a2935808afd5a491f3c5c312944ca08a78d0f3c
Link:
https://www.unpac.me/results/eb52eb6c-2c70-4f71-8c62-7fccff595a5f/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.14
Link:
https://yomi.yoroi.company/submissions/8166266902f013780f118f0b4673cb4d0553a68d1bc124b13fe95492975f19fe

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DridexLoader
Create hunting rule
Author:kevoreilly
Description:Dridex v4 dropper C2 parsing function
Rule name:DridexV4
Create hunting rule
Author:kevoreilly
Description:Dridex v4 Payload
Rule name:MALWARE_Win_DLLLoader
Create hunting rule
Author:ditekSHen
Description:Detects unknown DLL Loader

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/150865/

Comments