🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4280c27f9e3a0dae47929420089498fbef465f2daf892e7ddb04e1395c87cee4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Dridex


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4280c27f9e3a0dae47929420089498fbef465f2daf892e7ddb04e1395c87cee4
SHA3-384 hash: e64addadd7aa7bfd413cf6d3cf7098efa5745e5c695ff0aceb6ed919721397e18c508d6cb8b7e787df4760c7f8764d99
SHA1 hash: 36666363877fabf3a74aafd9f4e21b2aa3bfbc91
MD5 hash: 83378ce98f1aedcc7ac01a5b730ebd19
humanhash: leopard-north-pennsylvania-winner
File name:83378ce98f1aedcc7ac01a5b730ebd19.dll
Download: download sample
Signature Dridex
Create hunting rule
File size:204'800 bytes
First seen:2020-12-15 16:59:11 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash a23873606d43d18aeb728673d0ce4249 (15 x Dridex, 1 x Gozi)
ssdeep 3072:wFsIcCVMdHhbwlilXv+/dw7NN24M/1Z/NHPp6Yyb5RmShVo2D:wF32hXYd6rrM9BNCNYS
Threatray 44 similar samples on MalwareBazaar
TLSH FD149E41ABB60119F5FA073139FE79640AB57C094934FF5E3342B1ABAE39BD088947B1
Reporter abuse_ch
Tags:dll Dridex

Intelligence

File Origin
# of uploads :
1
# of downloads :
239
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/108190/
Detection(s):
SecuriteInfo.com.Generic.mg.cdbc398cb79b82eb.5282.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Sending a UDP request
Result
Threat name:
Unknown
Detection:
clean
Classification:
n/a
Score:
2 / 100
Link:
https://www.joesandbox.com/analysis/563530
Behaviour
Behavior Graph:
n/a
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4280c27f9e3a0dae47929420089498fbef465f2daf892e7ddb04e1395c87cee4/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2020-12-15 17:00:06 UTC
AV detection:
14 of 48 (29.17%)
Threat level:
  5/5
Verdict:
unknown
Similar samples:
0c0a849067910325d3a8d5a6fc5ee0e24f418e6ea2e2ac0a91f93b6c81b25434
Dridex
0d271154fc1009f8f0034bbda517dc5f188a99100d6ef8a5827319b3ea30afff
Dridex
119c6a4fbc1df623f74334c646cdd3444916427eacdb3d9222be9f758017492d
Dridex
12b51b1bb3f57abdd5ddff5a2c86dd416d12669d85c1a999a419de5195e8f46d
Dridex
25ca541958b7124f79002d471a96d08c3b6cd4b28320ebf344f0330169d80d9a
Dridex
4d5f2df879408856825785fe3a63a6a119d7f617f4fc52243fc060d2708bf993
Dridex
5188398a523a59bb95068adcfd096082f5ef204dbc572ee09fa09e2da2bc9dd9
Dridex
9723745ac74305a2b053a8b775bcf6f286786f8125af27752198a785877a2389
Dridex
c0b724f92582625dc7bc44c89ce1fda666b52dbcec3c78228da762822fc58e49
Dridex
eb3154fc479e6ec838bffbf7cb1f4247c4286625e2311bf6ba50abf7a48044a1
Dridex
+ 34 additional samples on MalwareBazaar
Result
Malware family:
dridex
Create hunting rule
Score:
  10/10
Tags:
family:dridex botnet loader
Link:
https://tria.ge/reports/201215-5qb6mmegzn/
Behaviour
Suspicious use of WriteProcessMemory
Dridex Loader
Dridex
Malware Config
C2 Extraction:
77.220.64.37:443
85.25.144.36:4643
51.15.176.55:3389
139.162.53.147:4443
Unpacked files
SH256 hash:
87bfeaa057d82beecb2be28c59ef5e37b5e0eea652a6c917a66b657e1195f135
MD5 hash:
59271a40af0afb52a6513b50c7db609b
SHA1 hash:
49ee94fdd64497837e220632211dc7302b301df6
Link:
https://www.unpac.me/results/7d3a67dc-4438-4206-ae19-d245813a3a92/
SH256 hash:
786d3bac534c2ac628e64b7c691b63e1d216fa188e3a64afa1c0eb5c559db318
MD5 hash:
8f176b11a13202271b1a89240844441b
SHA1 hash:
0956bd680f64b343538760fd5a1a228d4ab8446f
Detections:
win_dridex_auto
Create hunting rule
Link:
https://www.unpac.me/results/7d3a67dc-4438-4206-ae19-d245813a3a92/
Parent samples :
4d5f2df879408856825785fe3a63a6a119d7f617f4fc52243fc060d2708bf993
eb3154fc479e6ec838bffbf7cb1f4247c4286625e2311bf6ba50abf7a48044a1
786d3bac534c2ac628e64b7c691b63e1d216fa188e3a64afa1c0eb5c559db318
0c0a849067910325d3a8d5a6fc5ee0e24f418e6ea2e2ac0a91f93b6c81b25434
12b51b1bb3f57abdd5ddff5a2c86dd416d12669d85c1a999a419de5195e8f46d
119c6a4fbc1df623f74334c646cdd3444916427eacdb3d9222be9f758017492d
c0b724f92582625dc7bc44c89ce1fda666b52dbcec3c78228da762822fc58e49
330e60400c9e8c9ce5261540d31fb346d4a874eddee5040e465a03b368facb41
5188398a523a59bb95068adcfd096082f5ef204dbc572ee09fa09e2da2bc9dd9
0d271154fc1009f8f0034bbda517dc5f188a99100d6ef8a5827319b3ea30afff
25ca541958b7124f79002d471a96d08c3b6cd4b28320ebf344f0330169d80d9a
9723745ac74305a2b053a8b775bcf6f286786f8125af27752198a785877a2389
4280c27f9e3a0dae47929420089498fbef465f2daf892e7ddb04e1395c87cee4
99d8c0a7a6f68abe97bea4001cb14850de35ea9b0b35e2c40956b2f30595f378
9591987a6dcacd5edeeb4374628c09f8674bec41fa5beb0969bf2eeb10f7707c
041edba5ccd1c771382c57e623f3393248fd4c6cd86822a99061a571a531d1b9
03a4a28ccf750c1be52da2e87c729a26fe48c72007e03aba045ffd2a617c3a8e
SH256 hash:
4280c27f9e3a0dae47929420089498fbef465f2daf892e7ddb04e1395c87cee4
MD5 hash:
83378ce98f1aedcc7ac01a5b730ebd19
SHA1 hash:
36666363877fabf3a74aafd9f4e21b2aa3bfbc91
Link:
https://www.unpac.me/results/7d3a67dc-4438-4206-ae19-d245813a3a92/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.80
Link:
https://yomi.yoroi.company/submissions/4280c27f9e3a0dae47929420089498fbef465f2daf892e7ddb04e1395c87cee4

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Dridex

DLL dll 4280c27f9e3a0dae47929420089498fbef465f2daf892e7ddb04e1395c87cee4

(this sample)

Cape
Cape
https://www.capesandbox.com/analysis/108190/
  
URLhaus
https://urlhaus.abuse.ch/url/920552/
  
Delivery method
Distributed via web download

Comments