MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 08ddbd69aa6a6e0050e1b64c12f2ad2c5af69eec990a65a2ec0284243fcebb1c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Dridex


Vendor detections: 7


Intelligence 7 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 08ddbd69aa6a6e0050e1b64c12f2ad2c5af69eec990a65a2ec0284243fcebb1c
SHA3-384 hash: 46c4fae661a31db56c000f6221ef8433a05c07738a73d7e86da41654a4f5d31ba7103b919ff8ae0579c7fc84844b7a39
SHA1 hash: 7f6e82e17ccac8e829cc7404223ae82ead0880ad
MD5 hash: f6b8cfd410b23a505f06b7061d7b8d3a
humanhash: pip-colorado-mike-blue
File name:08ddbd69aa6a6e0050e1b64c12f2ad2c5af69eec990a65a2ec0284243fcebb1c
Download: download sample
Signature Dridex
Create hunting rule
File size:901'120 bytes
First seen:2020-11-06 10:59:22 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash aa57c18adc6cb59473049b210c72cd9b (13 x Dridex)
ssdeep 12288:bCJEFR/VdYyHiE6RaFPNN+bBKIwhjZWYKteZm75n:bCqf/VvHiE/NMdAKQm75n
Threatray 52 similar samples on MalwareBazaar
TLSH 8115D07293F98336F5FBB1B0E5B81920BD1DF991FA7A810BD01AC90558309E860B57B7
Reporter seifreed
Tags:Dridex

Intelligence

File Origin
# of uploads :
1
# of downloads :
62
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Malware.Bankerx-9787378-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Launching a process
Searching for the window
Creating a window
Changing a file
Forced system process termination
DNS request
Sending a custom TCP request
Forced shutdown of a system process
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/08ddbd69aa6a6e0050e1b64c12f2ad2c5af69eec990a65a2ec0284243fcebb1c/
Threat name:
Win32.Trojan.Drixed
Create hunting rule
Status:
Malicious
First seen:
2020-10-13 22:37:38 UTC
AV detection:
23 of 28 (82.14%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=bdo322nknjxaauhbwzgbf4vnfrnpnhxmtefglixmakccip6oxmoa._file
Verdict:
suspicious
Similar samples:
1003e3179583d7694d8bd7fbbe1fae629ac71cbef35a260a2288f600876b6bdc
Dridex
1db38d773d052e456749bb5fe1fd6ef045dedd30b8b1a0ae42bb62c26e9a2f18
Dridex
27379612c139d3c4a0c6614ea51d49f2495213c867574354d7851a86fdec2428
Dridex
5d2e121c650aea3012ab7891236953dd3b09672788a7be2e4a74716c59e94d98
Dridex
790b0d9e2b17f637c3e03e410aa22d16eccfefd28d74b226a293c9696edb60ad
Dridex
9b747e89874c0b080cf78ed61a1ccbd9c86045dc61b433116461e3e81eee1348
Dridex
c475b446e6d620ade6d55ef6eb7f75d29e2be8db678ca4df0254f355ec3b7e74
Dridex
ca59edc0f721f34fa3178168dcc138947f1370d1672a9653e42eec0327f2ec6a
Dridex
fd4159627ae84c3010c4fa3398c64d9639997d795338ab11fe2ad464f160b74e
Dridex
fee5bb973112d58445d9e267e0ceea137d9cc1fb8a7140cf9a67472c9499a30f
Dridex
+ 42 additional samples on MalwareBazaar
Result
Malware family:
dridex
Create hunting rule
Score:
  10/10
Tags:
family:dridex botnet evasion loader persistence trojan
Link:
https://tria.ge/reports/201106-253tm44a72/
Behaviour
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Checks SCSI registry key(s)
Enumerates system info in registry
Modifies Control Panel
Suspicious use of SetWindowsHookEx
Checks whether UAC is enabled
Enumerates connected drives
Modifies Installed Components in the registry
Dridex Loader
Dridex
Unpacked files
SH256 hash:
779b2672e9871e6b0ae75f0b698e7e9a55fbfa7a5905bc4fa14db6bda8bbe7b7
MD5 hash:
cf2b738117ab6a5b42ac870412d2a08f
SHA1 hash:
89a113b930a146836d6fbe2e1124b5e82b856401
Detections:
win_dridex_auto
Create hunting rule
Link:
https://www.unpac.me/results/af27d603-b146-4805-9167-a08ac82a286e/
SH256 hash:
c5280a45996dcb2228319d100e6795e37fdaa9df8d5477ef0260cc34563aaa3a
MD5 hash:
a2498204e373a28df38a02a5cfc01444
SHA1 hash:
9670e5e99e8e42ed5aea70c6f8be2baa911f9175
Detections:
win_dridex_auto
Create hunting rule
Link:
https://www.unpac.me/results/af27d603-b146-4805-9167-a08ac82a286e/
Parent samples :
08ddbd69aa6a6e0050e1b64c12f2ad2c5af69eec990a65a2ec0284243fcebb1c
87c5cc0860b21c1567249afb612ac41f574253341a8dee8912c99f34ced42fe6
8fb0488353fe8e23fe41da04eaa0c59b639e41371d9bb2ee2c628d81c322a372
94f7f97d1a7011ca17a4c4b4e0c1420937d2ed2d9beb6037edf4526031f661dd
740d02850542d0d29d86d871b289334cdec55608a6d4f08210e0a04d664012b7
95b67300462efd53cc88c9fa6c2cf21e558b3a3a09917f90a8491b10f4fda652
afa5aa95fb44edefde6e1e8ecbf28fbebf4b56c272e13bb42e49be640223e419
d5ab7b804bcfcd8941f44abd300b0b5df18f3ececf91a0072aa45bb72064ab21
e94e13000b458fea9b3da107479516b9f568dfeed7010747d1ab36d2ee363286
SH256 hash:
08ddbd69aa6a6e0050e1b64c12f2ad2c5af69eec990a65a2ec0284243fcebb1c
MD5 hash:
f6b8cfd410b23a505f06b7061d7b8d3a
SHA1 hash:
7f6e82e17ccac8e829cc7404223ae82ead0880ad
Link:
https://www.unpac.me/results/af27d603-b146-4805-9167-a08ac82a286e/
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DridexV4
Create hunting rule
Author:kevoreilly
Description:Dridex v4 Payload
Rule name:win_dridex_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator
Rule name:win_dridex_loader_v2
Create hunting rule
Author:Johannes Bader @viql
Description:detects some Dridex loaders

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other

Comments