MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 eced91f3ea5c7d6648f7033d82724cc7c33a3a88a051d19676a4494cf44260a2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Dridex


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: eced91f3ea5c7d6648f7033d82724cc7c33a3a88a051d19676a4494cf44260a2
SHA3-384 hash: 1d6b0aa6a3983e777385b4d5423d306d4c438fffd0d0837c282ff48febb9ee85eb723e9d9469170bb421e96a326ff313
SHA1 hash: 3899bcfd5b00a6adf49a9c96258e303d04f8565d
MD5 hash: da166d6673a537671d6775bea974a3a6
humanhash: solar-wyoming-yellow-oklahoma
File name:da166d66_by_Libranalysis
Download: download sample
Signature Dridex
Create hunting rule
File size:164'864 bytes
First seen:2021-05-05 22:02:03 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash bdaa0be01ce9860d02cb3111f632adfa (146 x Dridex)
ssdeep 3072:lf4Dcp/qdOUKcT1GpvO0nygcp0DvA/fxHbeXaUDwOvHvWM:aDBdOlG0nyg1DvwxgZ/v
Threatray 47 similar samples on MalwareBazaar
TLSH D7F3CFE89A9FC097E663583055FF37B6BA03D8478BC8DD10B281D52F5A1BD39DD09A01
Reporter Libranalysis
Tags:Dridex


Avatar
Libranalysis
Uploaded as part of the sample sharing project

Intelligence

File Origin
# of uploads :
1
# of downloads :
58
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/150797/
Detection(s):
SecuriteInfo.com.Mal.EncPk-APX.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Sending a UDP request
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/eced91f3ea5c7d6648f7033d82724cc7c33a3a88a051d19676a4494cf44260a2/
Threat name:
Win32.Trojan.GenericML
Create hunting rule
Status:
Malicious
First seen:
2021-05-05 22:02:15 UTC
AV detection:
17 of 47 (36.17%)
Threat level:
  5/5
Verdict:
unknown
Similar samples:
16b4fe51c3f1af8bcc3257e3b1e81433fdcac08e61bdefc95b5b10fb7a7bd74e
Dridex
17aeb7372b57d7559a6f507074fe1da973a104a2de8b0d8e229bfc4515c6d015
Dridex
1b3db260f69f51fd02533da364f56a4825e5ac0777ffc1fb68d54ce17662191e
Dridex
2ba11191a9da3d155b82d848577ee0b7eed0a90f86091d187bc157dd252a3d44
Dridex
41aceca0bb988c74c9320155126761b98d50c6e556a684070c8e3f3822464229
Dridex
4ec406d75588c4e395c1a5b93bf43da319684352061cf42876c704d92a52df92
Dridex
72306c6457c918bfaa19009cc21ae5eaf4bfad936e8694482c719f6f1c0c0266
Dridex
764f41b29285d1ad19f7bc5f0ad5d34255951cda7e24462e80bfe45847dbd545
Dridex
97d62d9cba3d8219f27c42650eb90fd3ee8aa4c7f478c76e30f88f11dd5e1a82
Dridex
9ff01c0edcf9082323a22fc225b4f2f7c9ff6d5b1f7c8d76c94da83b4c37ec25
Dridex
+ 37 additional samples on MalwareBazaar
Result
Malware family:
dridex
Create hunting rule
Score:
  10/10
Tags:
family:dridex botnet:22202 botnet loader
Link:
https://tria.ge/reports/210505-cwpqjgynt2/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Dridex Loader
Dridex
Malware Config
C2 Extraction:
45.55.134.126:443
67.207.83.96:8172
193.160.214.95:4125
Unpacked files
SH256 hash:
eced91f3ea5c7d6648f7033d82724cc7c33a3a88a051d19676a4494cf44260a2
MD5 hash:
da166d6673a537671d6775bea974a3a6
SHA1 hash:
3899bcfd5b00a6adf49a9c96258e303d04f8565d
Link:
https://www.unpac.me/results/55f4dd9d-33b7-413d-a57d-1faf29cf0d57/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.14
Link:
https://yomi.yoroi.company/submissions/eced91f3ea5c7d6648f7033d82724cc7c33a3a88a051d19676a4494cf44260a2

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/150797/

Comments