🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ca087f46f97cd465f46e4ccb04181e6eae7b2c751ae7fd9e262191b979728ccc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Dridex


Vendor detections: 13


Intelligence 13 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ca087f46f97cd465f46e4ccb04181e6eae7b2c751ae7fd9e262191b979728ccc
SHA3-384 hash: d917703f2df6816ac057d51f26060eaf152ff5f2ecc955ea37916050574ce1d0493aea75724de7493fa6b7b8f2ba37e8
SHA1 hash: 13cbfa1d79184d1cea84aef59e5c856117fd91c2
MD5 hash: 6285579d7082c55871b4b9dbe735255a
humanhash: south-kilo-batman-indigo
File name:ca087f46f97cd465f46e4ccb04181e6eae7b2c751ae7fd9e262191b979728ccc
Download: download sample
Signature Dridex
Create hunting rule
File size:208'896 bytes
First seen:2022-08-30 18:28:05 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash cdadd24365a6c20de1ab1c7bb5385624 (1 x Dridex)
ssdeep 6144:WG5/IZRVkgnLZf0V+H6fkmIF1nR5m0b+:W8/IZRyC500afUDh
Threatray 55 similar samples on MalwareBazaar
TLSH T1AD1412A92B65B64DF46B03B0C4FB57720260AE1EC0047E5EE55EDEDFCEF23258069618
TrID 32.2% (.EXE) Win64 Executable (generic) (10523/12/4)
20.1% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
15.4% (.EXE) Win16 NE executable (generic) (5038/12/1)
13.7% (.EXE) Win32 Executable (generic) (4505/5/1)
6.2% (.EXE) OS/2 Executable (generic) (2029/13)
Reporter OSimao
Tags:Dridex exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
351
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
feb_inv_749726.doc
Verdict:
Malicious activity
Analysis date:
2020-02-19 15:54:42 UTC
Tags:
encrypted loader
Link:
https://app.any.run/tasks/bf5530e5-ce17-4c04-b519-2cfdecf8057b

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
DridexV4
Create hunting rule
Link:
https://www.capesandbox.com/analysis/302780/
Detection(s):
SecuriteInfo.com.Trojan.Dridex.648.10567.13799.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Сreating synchronization primitives
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/31008/overview
Behaviour
MalwareBazaar
CheckCmdLine
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/630e57a1e87b88e71be5fbc2/reports/95d5adb0-b15d-4a41-8f97-1f72a98aa86f/overview
Malware family:
Dridex
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/e80e1208-1770-42e3-a00d-916c51adbbb9
Detection:
dridex
Create hunting rule
Link:
https://mwdb.cert.pl/sample/ca087f46f97cd465f46e4ccb04181e6eae7b2c751ae7fd9e262191b979728ccc/
Threat name:
Win32.Trojan.Zenpak
Create hunting rule
Status:
Malicious
First seen:
2020-02-19 16:49:30 UTC
File Type:
PE (Exe)
Extracted files:
1
AV detection:
31 of 41 (75.61%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=zieh6rxzptkgl5dojtfqiga6n2xhwldvdlt73hrgegi3s6lsrtga._file
Verdict:
malicious
Label(s):
dridex
Create hunting rule
Similar samples:
0b02474d4fc4a2d7d4b43562c4b8532e9880941610be7a955ce740fd6f959ac9
Dridex
33f58c125b2149fd2d4ab64d7014ba25b423bd8f190b0aac13e0de8c88049684
Dridex
3d0f043627dea5de72eae3fd54dd228dcc4320e8802200dbf21bcbe1cce0bf4a
Dridex
41a3586da1ade6096a5d254c93d071ed5bdd702ddbff61b5db3473495de412e6
Dridex
5528a39d6f2ca52ad81f936c75e2036cb91d0e88824f7a5abd67a601314b66bb
Dridex
6067b4d4febf1c025385eab5f40934d1ffe00e3ce2d6f5bb8f6481689d48ae72
Dridex
962f378f2e541433349acb928affd380f6d4960443ab39588115f920f43c71c6
Dridex
9c749e76dc4c135b3e3f87eac42b6aae70a8efec197f9d311917a665697c1bbd
Dridex
ce90df48bfadeec34a0e41e19bb140fda94c59fe3d27095b517da6bba4f9eeb3
Dridex
d3d026f833f38db4e9c43dd3b7371c3826e39d16ed6c0dfd69301584c6ac4783
Dridex
+ 45 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/220830-w4chdsdacm/
Behaviour
Suspicious behavior: GetForegroundWindowSpam
Unpacked files
SH256 hash:
2805660cc556fe0606c9b76a08e9c032092c90eaabe9f3c0aac46313f98f612d
MD5 hash:
be96a0910eb1987c167f7c2f51f69b74
SHA1 hash:
8ff3d4694c376bf5736a79ff070ff423e17be4c5
Detections:
win_dridex_g2
Create hunting rule
win_dridex_auto
Create hunting rule
Link:
https://www.unpac.me/results/b03fb8f8-d7e2-46dd-8a2b-f872ed085527/
SH256 hash:
ca087f46f97cd465f46e4ccb04181e6eae7b2c751ae7fd9e262191b979728ccc
MD5 hash:
6285579d7082c55871b4b9dbe735255a
SHA1 hash:
13cbfa1d79184d1cea84aef59e5c856117fd91c2
Link:
https://www.unpac.me/results/b03fb8f8-d7e2-46dd-8a2b-f872ed085527/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Dridex
Score:
0.90
Link:
https://yomi.yoroi.company/submissions/ca087f46f97cd465f46e4ccb04181e6eae7b2c751ae7fd9e262191b979728ccc

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Dridex

Executable exe ca087f46f97cd465f46e4ccb04181e6eae7b2c751ae7fd9e262191b979728ccc

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/316172/
  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/316188/
Cape
Cape
https://www.capesandbox.com/analysis/302780/

Comments