MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0263af7724d2ce102b22d81a54acece688022d99521b094068459f4bc4f6aca0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Dridex


Vendor detections: 7


Intelligence 7 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0263af7724d2ce102b22d81a54acece688022d99521b094068459f4bc4f6aca0
SHA3-384 hash: 4ffd72667f904ef68189d04bf19e967a7a61be1edcdaa5112f943c65b1d977a3183a7c76428b749fe646add001038b54
SHA1 hash: f32a1b54b0e1673386222322d433d876b2160d81
MD5 hash: 44066abaa499876d7f4ab6a098a7d532
humanhash: monkey-echo-emma-sink
File name:44066abaa499876d7f4ab6a098a7d532.dll
Download: download sample
Signature Dridex
Create hunting rule
File size:167'936 bytes
First seen:2020-12-22 08:26:09 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash aaf3f8a7e0fdc202353c68c4c54c5a75 (22 x Dridex)
ssdeep 3072:A1V+vpDx7DUQrMrXxomqF0uMfbaqPR7sOdBvFBnBXit/ba82MnJI:wMXDUQrOqFXMzaqNs8vATa82M
Threatray 13 similar samples on MalwareBazaar
TLSH BFF3E11361C6EB7CDB2204B25CEE138DD1348D10CE797B1DA66D709AA7FAFD10A89352
Reporter abuse_ch
Tags:dll Dridex

Intelligence

File Origin
# of uploads :
1
# of downloads :
272
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/108672/
Detection(s):
Win.Packed.Generic-9810928-0
Create hunting rule

SecuriteInfo.com.BehavesLike.Win32.Drixed.cc.28259.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Sending a UDP request
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Unknown
Detection:
suspicious
Classification:
n/a
Score:
22 / 100
Link:
https://www.joesandbox.com/analysis/568022
Signature
Machine Learning detection for sample
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 333083 Sample: P8XehCVBKK.dll Startdate: 22/12/2020 Architecture: WINDOWS Score: 22 12 Machine Learning detection for sample 2->12 6 loaddll32.exe 1 2->6         started        process3 process4 8 WerFault.exe 3 9 6->8         started        10 WerFault.exe 3 9 6->10         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0263af7724d2ce102b22d81a54acece688022d99521b094068459f4bc4f6aca0/
Threat name:
Win32.Trojan.Drixed
Create hunting rule
Status:
Malicious
First seen:
2020-12-22 08:27:05 UTC
AV detection:
24 of 29 (82.76%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
dridex
Create hunting rule
Similar samples:
09d4beff6b8ac12cc58777c675984ee929a260431741612048ac25f4341b753e
Dridex
0f1016beea87c7d751aff9f5ed596b452fdbd3bd9fb5405b76fa62014d89d54b
Dridex
2542d8801568e29aef85b91ee8ea89ce20bfbbb46954941745c88f68d6c9eb20
Dridex
35dc29c0132f1684fc8ed518f98d959bd982ef058b3ba24d8a23ea1507452621
Dridex
7eb170f9d34ad87ab2de388464d87041290fa7baacb2284d8ff02f358c46becd
Dridex
98f223299305b1c6994bd7ec18fbc0fc09260fc8bd542d02686e715769ed1fae
Dridex
9c29b1e8d9212da8dd9ed375d5722ceabf65c13fab3c12c9c258530b38630628
Dridex
b40a11dcea513d7f8119735975a133c896592a804f003074e735015e35f43468
Dridex
db05b73f6963ec3d5bbaebbde3545dd801b79a54a41d583146a556b0f4505515
Dridex
e94e13000b458fea9b3da107479516b9f568dfeed7010747d1ab36d2ee363286
Dridex
+ 3 additional samples on MalwareBazaar
Result
Malware family:
dridex
Create hunting rule
Score:
  10/10
Tags:
family:dridex botnet loader
Link:
https://tria.ge/reports/201222-a3haxmh452/
Behaviour
Suspicious use of WriteProcessMemory
Dridex Loader
Dridex
Malware Config
C2 Extraction:
172.86.186.22:3889
46.105.131.78:14431
103.244.206.74:33443
139.162.53.147:4443
Unpacked files
SH256 hash:
0263af7724d2ce102b22d81a54acece688022d99521b094068459f4bc4f6aca0
MD5 hash:
44066abaa499876d7f4ab6a098a7d532
SHA1 hash:
f32a1b54b0e1673386222322d433d876b2160d81
Link:
https://www.unpac.me/results/d0f6d261-00f8-4d35-bac3-270e63c2d798/
SH256 hash:
f42c2c58861b113ad40bb7ba9cbefb86633c54da70f1cde40396394e884eba1b
MD5 hash:
41a2132eaf29473bba86a251fc3fed80
SHA1 hash:
069de24cc0e6b689f1a3a155eee01eedbadda7b2
Link:
https://www.unpac.me/results/d0f6d261-00f8-4d35-bac3-270e63c2d798/
SH256 hash:
b087ecd864078c49e02d43814d841d6c067ba741341483d9c58cba949fa8a57b
MD5 hash:
c596bcc0b81290429e95e80bc3d1163c
SHA1 hash:
50fd69c49784f20742ec9a983c6888a7259d8834
Detections:
win_dridex_auto
Create hunting rule
Link:
https://www.unpac.me/results/d0f6d261-00f8-4d35-bac3-270e63c2d798/
Parent samples :
b40a11dcea513d7f8119735975a133c896592a804f003074e735015e35f43468
0f1016beea87c7d751aff9f5ed596b452fdbd3bd9fb5405b76fa62014d89d54b
2542d8801568e29aef85b91ee8ea89ce20bfbbb46954941745c88f68d6c9eb20
09d4beff6b8ac12cc58777c675984ee929a260431741612048ac25f4341b753e
0263af7724d2ce102b22d81a54acece688022d99521b094068459f4bc4f6aca0
98f223299305b1c6994bd7ec18fbc0fc09260fc8bd542d02686e715769ed1fae
9c29b1e8d9212da8dd9ed375d5722ceabf65c13fab3c12c9c258530b38630628
db05b73f6963ec3d5bbaebbde3545dd801b79a54a41d583146a556b0f4505515
1670a34f9c0f49e6ba51de133293371ef77aa21442aaf4698eac0163ec68ff2e
94d02d97cf6989fbdb3010543f747751dc6ff9709c854323c7959a386bad43d3
2e8384b979521ab1a3ac17745f81d9a18fa084294d242d4a6918db4413e313c6
ed8e649fba97f6ef44c5ae7b5dc4c57d71aa28ea60063986f9edb9a0338d2748
1a13b0a4251771ac84bff5b2009e1fbd8eb2c8fdbd1299ba64299f40a2ad0e7d
a8289357cdb5e5a75f6d8e6fea9e74863f16e51c913123bd7cc442e818f258b6
b1c5f8455b82ed52709846267e516590c9e97019fe406691eb5b100e45e3bd78
a81a824a4030808e0998064a90a4905fa87808e46f75c0c8d38a8f771a0d3288
2cb94e38a1930e97de56e8a310155f8b98f4effa7ffd5e3553bec6f5f9539fb2
eac020aa33b9585b92e202a58b1924b1b628a7cad2d39236b423110c221fa481
ac0e2a63a741fe311d13210f830d6995ade78652b6705420d1c382cd8a825eab
88813cbb3272347ca08a88e9ce1064bfdaf317d564c8c22c377f18a6e6fa2618
84f85c52fe3defb96af28e575a590505991fcdb447a30825d9e4d3d6b1eaaf0f
0ca4f84f42c000128a1451ffafb83a1bc482fcb79dc5ff4a4b1263d7a9313391
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.24
Link:
https://yomi.yoroi.company/submissions/0263af7724d2ce102b22d81a54acece688022d99521b094068459f4bc4f6aca0

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Dridex

DLL dll 0263af7724d2ce102b22d81a54acece688022d99521b094068459f4bc4f6aca0

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/924781/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/108672/

Comments