MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 09d4beff6b8ac12cc58777c675984ee929a260431741612048ac25f4341b753e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Dridex


Vendor detections: 7


Intelligence 7 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 09d4beff6b8ac12cc58777c675984ee929a260431741612048ac25f4341b753e
SHA3-384 hash: 63fdfd800a0db66069bb568bf3b5e27e33f6bdec96f6b12cd601bc5fc116b95d68839a17f0c805ed85a24d0a68a5959b
SHA1 hash: 1c276a6ca50977398e7bf25694b6b18a780f69d2
MD5 hash: fec575a0391e690af9cf0f2481a735c0
humanhash: mockingbird-river-salami-fruit
File name:fec575a0391e690af9cf0f2481a735c0.dll
Download: download sample
Signature Dridex
Create hunting rule
File size:167'936 bytes
First seen:2020-12-21 07:50:57 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash aaf3f8a7e0fdc202353c68c4c54c5a75 (22 x Dridex)
ssdeep 3072:E1V+vpDx7DUQrMrXxomqF0uMfbaqPR7sOdBvFBnBXit/ba82MnJI:0MXDUQrOqFXMzaqNs8vATa82M
Threatray 9 similar samples on MalwareBazaar
TLSH 35F3E11361C6EB7CDB2204B25CEE138DD1348D10CE797B1DA66D709AA7FAFD10A89352
Reporter abuse_ch
Tags:dll Dridex

Intelligence

File Origin
# of uploads :
1
# of downloads :
192
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Packed.Generic-9810928-0
Create hunting rule

SecuriteInfo.com.BehavesLike.Win32.Drixed.cc.28259.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Sending a UDP request
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Unknown
Detection:
suspicious
Classification:
n/a
Score:
21 / 100
Link:
https://www.joesandbox.com/analysis/567239
Signature
Machine Learning detection for sample
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 332700 Sample: 27YeoHFSBT.dll Startdate: 21/12/2020 Architecture: WINDOWS Score: 21 12 Machine Learning detection for sample 2->12 6 loaddll32.exe 1 2->6         started        process3 process4 8 WerFault.exe 3 9 6->8         started        10 WerFault.exe 3 9 6->10         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/09d4beff6b8ac12cc58777c675984ee929a260431741612048ac25f4341b753e/
Threat name:
Win32.Trojan.Drixed
Create hunting rule
Status:
Malicious
First seen:
2020-12-21 07:51:04 UTC
AV detection:
24 of 29 (82.76%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=bhkl573lrlaszrmho7dhlgco5eu2eycdc5awcicivqs7ina3ou7a._file
Verdict:
unknown
Similar samples:
07ef09d52046d7f370a8eb7a0058834eec30b59424d2a804bad3a1794e7c0f61
Dridex
0f1016beea87c7d751aff9f5ed596b452fdbd3bd9fb5405b76fa62014d89d54b
Dridex
2542d8801568e29aef85b91ee8ea89ce20bfbbb46954941745c88f68d6c9eb20
Dridex
35dc29c0132f1684fc8ed518f98d959bd982ef058b3ba24d8a23ea1507452621
Dridex
7eb170f9d34ad87ab2de388464d87041290fa7baacb2284d8ff02f358c46becd
Dridex
9290d818ef8373a1ba99a14b5982552648ea54fc9ed468019a1ab2a4f833e6a2
Dridex
b40a11dcea513d7f8119735975a133c896592a804f003074e735015e35f43468
Dridex
e94e13000b458fea9b3da107479516b9f568dfeed7010747d1ab36d2ee363286
Dridex
f0ecc44eacafdb97e9a84785bbdcffce312393c0e219d27040b42a3d4c93f45e
Dridex
Result
Malware family:
dridex
Create hunting rule
Score:
  10/10
Tags:
family:dridex botnet loader
Link:
https://tria.ge/reports/201221-77s7bvwqaj/
Behaviour
Suspicious use of WriteProcessMemory
Dridex Loader
Dridex
Malware Config
C2 Extraction:
172.86.186.22:3889
46.105.131.78:14431
103.244.206.74:33443
139.162.53.147:4443
Unpacked files
SH256 hash:
09d4beff6b8ac12cc58777c675984ee929a260431741612048ac25f4341b753e
MD5 hash:
fec575a0391e690af9cf0f2481a735c0
SHA1 hash:
1c276a6ca50977398e7bf25694b6b18a780f69d2
Link:
https://www.unpac.me/results/a5ff6ba3-75b0-4fec-9c30-2f601ab2178a/
SH256 hash:
cd169508324ebc4d88ab14dc5726346cf1e69eb91d019ac96d8d201ee8cb81ba
MD5 hash:
7a11ad372272c815ccaf26c640bb81d4
SHA1 hash:
78d037f4eddfa0b33a54fff8082571225ad3c75b
Link:
https://www.unpac.me/results/a5ff6ba3-75b0-4fec-9c30-2f601ab2178a/
SH256 hash:
b087ecd864078c49e02d43814d841d6c067ba741341483d9c58cba949fa8a57b
MD5 hash:
c596bcc0b81290429e95e80bc3d1163c
SHA1 hash:
50fd69c49784f20742ec9a983c6888a7259d8834
Detections:
win_dridex_auto
Create hunting rule
Link:
https://www.unpac.me/results/a5ff6ba3-75b0-4fec-9c30-2f601ab2178a/
Parent samples :
b40a11dcea513d7f8119735975a133c896592a804f003074e735015e35f43468
0f1016beea87c7d751aff9f5ed596b452fdbd3bd9fb5405b76fa62014d89d54b
2542d8801568e29aef85b91ee8ea89ce20bfbbb46954941745c88f68d6c9eb20
09d4beff6b8ac12cc58777c675984ee929a260431741612048ac25f4341b753e
0263af7724d2ce102b22d81a54acece688022d99521b094068459f4bc4f6aca0
98f223299305b1c6994bd7ec18fbc0fc09260fc8bd542d02686e715769ed1fae
9c29b1e8d9212da8dd9ed375d5722ceabf65c13fab3c12c9c258530b38630628
db05b73f6963ec3d5bbaebbde3545dd801b79a54a41d583146a556b0f4505515
1670a34f9c0f49e6ba51de133293371ef77aa21442aaf4698eac0163ec68ff2e
94d02d97cf6989fbdb3010543f747751dc6ff9709c854323c7959a386bad43d3
2e8384b979521ab1a3ac17745f81d9a18fa084294d242d4a6918db4413e313c6
ed8e649fba97f6ef44c5ae7b5dc4c57d71aa28ea60063986f9edb9a0338d2748
1a13b0a4251771ac84bff5b2009e1fbd8eb2c8fdbd1299ba64299f40a2ad0e7d
a8289357cdb5e5a75f6d8e6fea9e74863f16e51c913123bd7cc442e818f258b6
b1c5f8455b82ed52709846267e516590c9e97019fe406691eb5b100e45e3bd78
a81a824a4030808e0998064a90a4905fa87808e46f75c0c8d38a8f771a0d3288
2cb94e38a1930e97de56e8a310155f8b98f4effa7ffd5e3553bec6f5f9539fb2
eac020aa33b9585b92e202a58b1924b1b628a7cad2d39236b423110c221fa481
ac0e2a63a741fe311d13210f830d6995ade78652b6705420d1c382cd8a825eab
88813cbb3272347ca08a88e9ce1064bfdaf317d564c8c22c377f18a6e6fa2618
84f85c52fe3defb96af28e575a590505991fcdb447a30825d9e4d3d6b1eaaf0f
0ca4f84f42c000128a1451ffafb83a1bc482fcb79dc5ff4a4b1263d7a9313391
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.24
Link:
https://yomi.yoroi.company/submissions/09d4beff6b8ac12cc58777c675984ee929a260431741612048ac25f4341b753e

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Dridex

DLL dll 09d4beff6b8ac12cc58777c675984ee929a260431741612048ac25f4341b753e

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/924783/
  
Delivery method
Distributed via web download

Comments