MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2d7c7b9472f1f4bb2f678822f16e8575971574ba763bd9e98fdb7d8b2a8f5d2e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Dridex


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2d7c7b9472f1f4bb2f678822f16e8575971574ba763bd9e98fdb7d8b2a8f5d2e
SHA3-384 hash: 173a08695f0ab37bcc8ea7a1bb83ee286efd840b305d9417d43bfab778e114a5fd1cc20bed380286deffc976cd0baa9e
SHA1 hash: 77b24c8ba771792da6aec76f4ec248f0ecb235c3
MD5 hash: 9bce97f19e31a1e3b783ac32d2c726fa
humanhash: king-mississippi-delaware-lactose
File name:m4UuMVPa
Download: download sample
Signature Dridex
Create hunting rule
File size:331'776 bytes
First seen:2020-09-21 12:16:41 UTC
Last seen:2020-09-21 17:17:38 UTC
File type:DLL dll
MIME type:application/x-dosexec
imphash 76ca4b0770cd5a3fae865eb520597417 (6 x Dridex)
ssdeep 6144:Eud4KJ4hF7popQTRq3va4jl6u31Ut+Ji370HnBs4NeuVCC:O7yUReva4jlNoQnBXek1
Threatray 45 similar samples on MalwareBazaar
TLSH 7864D17F32E9619CF7BBABB885B40216456A3DEAAD38D58D03011C698363374CCD5B72
Reporter JAMESWT_WT
Tags:Dridex

Intelligence

File Origin
# of uploads :
4
# of downloads :
165
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Detection(s):
SecuriteInfo.com.Generic.mg.9bce97f19e31a1e3.28336.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Sending a UDP request
Result
Threat name:
Unknown
Detection:
malicious
Classification:
n/a
Score:
52 / 100
Link:
https://www.joesandbox.com/analysis/471194
Signature
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 288032 Sample: m4UuMVPa Startdate: 21/09/2020 Architecture: WINDOWS Score: 52 10 Multi AV Scanner detection for submitted file 2->10 12 Machine Learning detection for sample 2->12 6 loaddll32.exe 1 2->6         started        process3 process4 8 WerFault.exe 3 9 6->8         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/2d7c7b9472f1f4bb2f678822f16e8575971574ba763bd9e98fdb7d8b2a8f5d2e/
Threat name:
Win32.Infostealer.Dridex
Create hunting rule
Status:
Malicious
First seen:
2020-09-21 12:16:32 UTC
File Type:
PE (Dll)
AV detection:
22 of 28 (78.57%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
dridex
Create hunting rule
emotet
Create hunting rule
Similar samples:
0f63e8fa69f0d37bfe7ae6c545e19972c9f1432b804dc1d051bfc1ceed49afa4
Dridex
2ee89b249239c74f9862bd5da57e36780142f8a5cbaecda5d102cae097d6cfd6
Dridex
5e55bed21d40097b28a4e7eeb0cfbd128c5518b60ba9453bd6ffd7f3d2743114
Dridex
69f0200223c9d03d6150c4d0e5bab6dd5654618400716a84a61dc018dc61e57f
Dridex
ac9bdf7234d6fdcb50f8be07e0eadbcec5e07e028aa44d85cda6805a24d86e62
Dridex
accc34541e27e46f4b46339eb25fee6cdccef3c18a849bea359998ebc28f6b59
Dridex
bdf8709d58ab512229a343fba8788770076afd816dc2e9a9abcb803d72bf84b4
Dridex
c4a5fb821fb93ebac8bf91a8cb2097c6f920528bc3803bcd26d70e1f1bd9b201
Dridex
f513355f3b913c24be0ba4e03d4f855b953bb8a616368c5a217d33988742f871
Dridex
fd4159627ae84c3010c4fa3398c64d9639997d795338ab11fe2ad464f160b74e
Dridex
+ 35 additional samples on MalwareBazaar
Result
Malware family:
dridex
Create hunting rule
Score:
  10/10
Tags:
botnet loader family:dridex
Link:
https://tria.ge/reports/200921-hv3vlvatfn/
Behaviour
Suspicious use of WriteProcessMemory
Dridex Loader
Dridex
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Virus
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/2d7c7b9472f1f4bb2f678822f16e8575971574ba763bd9e98fdb7d8b2a8f5d2e

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Dridex

DLL dll 2d7c7b9472f1f4bb2f678822f16e8575971574ba763bd9e98fdb7d8b2a8f5d2e

(this sample)

Cape
Cape
https://www.capesandbox.com/analysis/37/
  
URLhaus
https://urlhaus.abuse.ch/url/585776/
  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/585779/
  
URLhaus
https://urlhaus.abuse.ch/url/585783/

Comments