MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3ab48ca45cd8a40aa0100279752afd3e89003bb85bf420c8b1be62e019f4c9eb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Dridex


Vendor detections: 7


Intelligence 7 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3ab48ca45cd8a40aa0100279752afd3e89003bb85bf420c8b1be62e019f4c9eb
SHA3-384 hash: be38d42812e884f7397b3c4eacf444afd799bc457ea509358b63a5e2be932ae6fa7f793b5582bb4329d56e80fbb2f12b
SHA1 hash: 7c6692e00af5e345c70d98862d6dacccc283e05e
MD5 hash: 26a799534430589b72111ccb335c2400
humanhash: mirror-grey-fourteen-fanta
File name:DRIDEX (2)
Download: download sample
Signature Dridex
Create hunting rule
File size:327'680 bytes
First seen:2020-09-24 07:37:19 UTC
Last seen:2020-09-24 08:37:07 UTC
File type:DLL dll
MIME type:application/x-dosexec
imphash 0711eaedc93119f4fba09fc656e118ab (7 x Dridex)
ssdeep 3072:Z4LaiXGwW6f3ny73vo0FbxbqOwO42GLSGL5UUoIPjgbgba5ytyiqNTPmvvld2hJk:ZBrwXy7wvxSGGJIPje150vld3s5pd
Threatray 34 similar samples on MalwareBazaar
TLSH 5564E1113AE65929F6B36B708DBB05048B1F7E912C3C81CE86111B5A9A63640CFE7FB5
Reporter JAMESWT_WT
Tags:Dridex

Intelligence

File Origin
# of uploads :
2
# of downloads :
155
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Detection(s):
SecuriteInfo.com.Trojan.Dridex.735.18498.30839.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:
Result
Threat name:
Unknown
Detection:
malicious
Classification:
n/a
Score:
52 / 100
Link:
https://www.joesandbox.com/analysis/474060
Signature
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 289476 Sample: DRIDEX (2) Startdate: 24/09/2020 Architecture: WINDOWS Score: 52 10 Multi AV Scanner detection for submitted file 2->10 12 Machine Learning detection for sample 2->12 6 loaddll32.exe 1 2->6         started        process3 process4 8 WerFault.exe 3 9 6->8         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/3ab48ca45cd8a40aa0100279752afd3e89003bb85bf420c8b1be62e019f4c9eb/
Threat name:
Win32.Infostealer.Dridex
Create hunting rule
Status:
Malicious
First seen:
2020-09-24 01:14:00 UTC
File Type:
PE (Dll)
AV detection:
23 of 29 (79.31%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
dridex
Create hunting rule
Similar samples:
147ebcc44853cc5a776a50bb099177d4d87e00960aec208d2283f0b0c8c08b99
Dridex
1f8dc085e250847f7a31d7785710be49b17eed1e1c6e460478e2e5232bda689a
Dridex
2c57cdeb1938688244dcaf05544e47daef28a6cec2866a674df9b6a4ed45237a
Dridex
8ae193225bd1a7192315a7003aa4aa9565c573b6078f48cc9e290c9b0798235e
Dridex
92794ce2b86f5636b0636952f7ac4b02f0fd664b5f479372d64aa779d376a7a2
Dridex
b6061934972e541bf1f421f92c7342892661ebb98f75bd833b4c14ddbdd9291f
Dridex
cd4ccf6b266b11aa29327444754c4c42f175725c4c03e21cf5dae151a4c4aa41
Dridex
d9405516d908f39043c9971884df73b57ae6db3002364444ec9b4e2a1d026ddb
Dridex
dd39accfa55be48b2c14f264a5917ead4964b8a7ce7f3f113cc74d13f87e86e7
Dridex
fd4159627ae84c3010c4fa3398c64d9639997d795338ab11fe2ad464f160b74e
Dridex
+ 24 additional samples on MalwareBazaar
Result
Malware family:
dridex
Create hunting rule
Score:
  10/10
Tags:
botnet loader family:dridex
Link:
https://tria.ge/reports/200924-dhbsc5nbg2/
Behaviour
Suspicious use of WriteProcessMemory
Dridex Loader
Dridex
Malware Config
C2 Extraction:
151.236.219.181:443
142.4.6.57:14043
162.144.127.197:3786
103.40.116.68:5443
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Alureon
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/3ab48ca45cd8a40aa0100279752afd3e89003bb85bf420c8b1be62e019f4c9eb

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Dridex

DLL dll 3ab48ca45cd8a40aa0100279752afd3e89003bb85bf420c8b1be62e019f4c9eb

(this sample)

Cape
Cape
https://www.capesandbox.com/analysis/65264/
  
URLhaus
https://urlhaus.abuse.ch/url/609445/
  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/609447/
  
URLhaus
https://urlhaus.abuse.ch/url/609450/
  
URLhaus
https://urlhaus.abuse.ch/url/609453/

Comments