MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 853ac6f84a9eace14a817fd180585f76b263a66f072f3236842737301a047f29. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Dridex
Vendor detections: 7
| SHA256 hash: | 853ac6f84a9eace14a817fd180585f76b263a66f072f3236842737301a047f29 |
|---|---|
| SHA3-384 hash: | d4465b34b02fa11d01e6015df8cbe1a3fad410e12c1e185d18cbc6678d8129cafb96f39af8f0492893f2d47cf15cc7e4 |
| SHA1 hash: | 66eda52836dc334d28a6fafac6b0dc710566c0e8 |
| MD5 hash: | 2891d8c482481e660ced703ce8b6dd8e |
| humanhash: | blue-mountain-don-vermont |
| File name: | uoFBiRLxWl.dll |
| Download: | download sample |
| Signature | Dridex |
| File size: | 167'936 bytes |
| First seen: | 2020-12-02 18:33:03 UTC |
| Last seen: | 2020-12-02 21:21:39 UTC |
| File type: |  dll |
| MIME type: | application/x-dosexec |
| imphash | 8c139089d78137abf164f71dfb6637c7 (1 x Dridex) |
| ssdeep | 3072:dAkzrvTXX6m6acOf1QwRBsdeUb8Oy7YuLg0Gjj5D:pvvbLdRAesA7YU2 |
| Threatray | 3 similar samples on MalwareBazaar |
| TLSH | 17F3E168E5F7AA07DEE54C3D5C676276CCB4FE11990258EED3F894CADA050D128F0B0A |
| Reporter |  James_inthe_box |
| Tags: | dll Dridex |
Intelligence
File Origin
# of uploads :
2
# of downloads :
171
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Result
Verdict:
Clean
Maliciousness:
Behaviour
Sending a UDP request
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Unknown
Detection:
suspicious
Classification:
n/a
Score:
23 / 100
Signature
Machine Learning detection for sample
Behaviour
Behavior Graph:
Threat name:
Win32.Trojan.Wacatac
Status:
Malicious
First seen:
2020-12-02 18:32:52 UTC
File Type:
PE (Dll)
AV detection:
18 of 28 (64.29%)
Threat level:
5/5
Result
Malware family:
dridex
Score:
10/10
Tags:
family:dridex botnet loader
Behaviour
Suspicious use of WriteProcessMemory
Dridex Loader
Dridex
Malware Config
C2 Extraction:
169.255.216.36:443
123.231.252.10:4646
85.25.109.116:3889
91.83.93.89:4643
123.231.252.10:4646
85.25.109.116:3889
91.83.93.89:4643
Unpacked files
SH256 hash:
853ac6f84a9eace14a817fd180585f76b263a66f072f3236842737301a047f29
MD5 hash:
2891d8c482481e660ced703ce8b6dd8e
SHA1 hash:
66eda52836dc334d28a6fafac6b0dc710566c0e8
SH256 hash:
cfa26bb830cd2b75231777f453c66bd7e5e1db5e95c26199bba6aea0efd0e117
MD5 hash:
1cc3d564461aca4afd3eed11097cac3d
SHA1 hash:
881c3abc8d5fb0d8d73b09124ff625b65c5cc68e
SH256 hash:
cf733e5df37a3d7ca9de8a0c24dbf53c965266238f4e583294132f42d9eb036e
MD5 hash:
75b9a584cd6af471ca9099f0ff41509e
SHA1 hash:
70b59a59bbbb48075b53ac515399213cac8b6081
Detections:
win_dridex_auto
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Trojan
Score:
1.00
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Delivery method
Other
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.