MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 1d4b85e1b491f06bde4c24dba1add4699ba5cebae563eda46aed25b085a139a7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Dridex
Vendor detections: 7
| SHA256 hash: | 1d4b85e1b491f06bde4c24dba1add4699ba5cebae563eda46aed25b085a139a7 |
|---|---|
| SHA3-384 hash: | 77321f0dc72174a1120582a7861f7900fee254547a5ebf8eaccea69a9bba68f7d0b36a4b5ddcc220f9ad9d2d6f52b837 |
| SHA1 hash: | f53a9734ab4fa05eb43627fde95b44206eb5b32e |
| MD5 hash: | 3449f7185f5bbe30c0f1af3c27123143 |
| humanhash: | mirror-tennis-maryland-oscar |
| File name: | zfaFOUkR.dll |
| Download: | download sample |
| Signature | Dridex |
| File size: | 204'800 bytes |
| First seen: | 2020-12-24 06:51:00 UTC |
| Last seen: | 2020-12-24 08:54:15 UTC |
| File type: |  dll |
| MIME type: | application/x-dosexec |
| imphash | ff4887da2f409d7cc45957b36b659281 (2 x Dridex) |
| ssdeep | 3072:24jjoaPs7Our2PG+z9axt25Oer1XNPVscXKIXtpKvOj0uYOx2Ju:9joH2++zlxVX7+2bh |
| Threatray | 42 similar samples on MalwareBazaar |
| TLSH | 2914BD02EFA72B00FC2706FF58DC45525C31BC228932E96AA5D3379A65FDA178F50369 |
| Reporter |  JAMESWT_WT |
| Tags: | dll Dridex |
Intelligence
File Origin
# of uploads :
2
# of downloads :
569
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Detection(s):
Result
Verdict:
Clean
Maliciousness:
Behaviour
Sending a UDP request
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Unknown
Detection:
malicious
Classification:
n/a
Score:
52 / 100
Signature
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Threat name:
Win32.Trojan.Drixed
Status:
Malicious
First seen:
2020-12-24 06:51:04 UTC
File Type:
PE (Dll)
Extracted files:
15
AV detection:
18 of 29 (62.07%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
unknown
Similar samples:
+ 32 additional samples on MalwareBazaar
Result
Malware family:
dridex
Score:
10/10
Tags:
family:dridex botnet loader
Behaviour
Suspicious use of WriteProcessMemory
Dridex Loader
Dridex
Malware Config
C2 Extraction:
51.75.24.85:443
213.202.229.72:3074
202.91.8.121:4643
195.231.69.151:3889
213.202.229.72:3074
202.91.8.121:4643
195.231.69.151:3889
Unpacked files
SH256 hash:
cc212591fdb894c457ab2046010527068c9148f61232828ff30e0232407f2332
MD5 hash:
3fbbe90f965ff0a1cc7a13059b61cad6
SHA1 hash:
40e87542a9eb45da8433eaf84eda4abd4efe4b6a
SH256 hash:
5599afc1f78db4e3d974434487fb3af1527d9688b3e01d90433cc0d7104855c7
MD5 hash:
d7f65036d4c0e330a3a4c5306fdaf6dd
SHA1 hash:
0661d575eac702962097448e6e5f2e589ac020b3
Detections:
win_dridex_auto
SH256 hash:
1d4b85e1b491f06bde4c24dba1add4699ba5cebae563eda46aed25b085a139a7
MD5 hash:
3449f7185f5bbe30c0f1af3c27123143
SHA1 hash:
f53a9734ab4fa05eb43627fde95b44206eb5b32e
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.24
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.