MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d7f98d07bf92683805e0ad58ff9035246409c9198659d00c7c2c3465ba3d04a4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Dridex

Vendor detections: 4

Intelligence 4 IOCs YARA File information Comments 1

SHA256 hash:	d7f98d07bf92683805e0ad58ff9035246409c9198659d00c7c2c3465ba3d04a4
SHA3-384 hash:	aed9625eb2d5925961394e4ee3c3121e698b121d414a5df8dbb84cacfc5f29da3e02b215018cef36cc1a5048a81263b4
SHA1 hash:	fcdf4597749649eebc31c503fa2fe4e7159977aa
MD5 hash:	c3ccd49268dab8f4865df0e05dc85e07
humanhash:	tango-jupiter-sad-chicken
File name:	c3ccd492_by_Libranalysis
Download:	download sample
Signature	Dridex Create hunting rule
File size:	164'864 bytes
First seen:	2021-05-05 22:09:43 UTC
Last seen:	Never
File type:	dll
MIME type:	application/x-dosexec
imphash	bdaa0be01ce9860d02cb3111f632adfa (146 x Dridex)
ssdeep	3072:df4Dcp/qdOUKcT1GpvO0nygcp0DvA/fxHbeXaUDwOvHvWM:SDBdOlG0nyg1DvwxgZ/v
Threatray	79 similar samples on MalwareBazaar
TLSH	36F3CFE89A9FC097E663583055FF37B6BA03D8478BC8DD10B281D52F5A1BD39DD09A01
Reporter	Libranalysis
Tags:	Dridex

Libranalysis

Uploaded as part of the sample sharing project

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/150936/

Detection(s):

SecuriteInfo.com.Mal.EncPk-APX.UNOFFICIAL

Result

Verdict:

Clean

Maliciousness:

Behaviour

Sending a UDP request

Result

Verdict:

UNKNOWN

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/d7f98d07bf92683805e0ad58ff9035246409c9198659d00c7c2c3465ba3d04a4/

Threat name:

Win32.Trojan.Wacatac

Status:

Malicious

First seen:

2021-05-05 22:10:34 UTC

AV detection:

15 of 47 (31.91%)

Threat level:

5/5

Result

Malware family:

dridex

Score:

10/10

Tags:

family:dridex botnet:22202 botnet loader

Link:

https://tria.ge/reports/210505-8wj45h63b6/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Program crash

Dridex Loader

Dridex

Malware Config

C2 Extraction:

45.55.134.126:443
67.207.83.96:8172
193.160.214.95:4125

Unpacked files

SH256 hash:

d7f98d07bf92683805e0ad58ff9035246409c9198659d00c7c2c3465ba3d04a4

MD5 hash:

c3ccd49268dab8f4865df0e05dc85e07

SHA1 hash:

fcdf4597749649eebc31c503fa2fe4e7159977aa

Link:

https://www.unpac.me/results/eda3cd89-8f0f-461c-bf90-7eac58278ac9/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/d7f98d07bf92683805e0ad58ff9035246409c9198659d00c7c2c3465ba3d04a4

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/150936/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

a̵c̵c̸i̵d̷e̵n̷t̴a̷l̴r̵e̷b̸e̴l̸ commented on 2021-05-05 23:21:02 UTC

============================================================
MBC behaviors list (github.com/accidentalrebel/mbcscan):
============================================================
0) [B0001.025] Anti-Behavioral Analysis::Software Breakpoints
1) [B0009] Anti-Behavioral Analysis::Virtual Machine Detection