MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4583e87b6fc0bc83030af01bdfb800be4d3ee3807b22b28e263447ea2f863a36. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Dridex


Vendor detections: 8


Intelligence 8 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4583e87b6fc0bc83030af01bdfb800be4d3ee3807b22b28e263447ea2f863a36
SHA3-384 hash: ebf26f4fe5eda1583d9975032c0a89dd985af88146fff35a6104e44bea9c77386dd89ce0e3d3041d2fe2fb92dfda8d68
SHA1 hash: b1d9b15f13c242d449104978d9fa8541cb233188
MD5 hash: 25d874573154be6d3d14ae6e97426536
humanhash: sierra-eight-lake-bravo
File name:4583e87b6fc0bc83030af01bdfb800be4d3ee3807b22b28e263447ea2f863a36.dll
Download: download sample
Signature Dridex
Create hunting rule
File size:1'613'824 bytes
First seen:2021-08-25 13:08:57 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash fda3a22e2f2e36b962ee2cf265556e81 (1 x Dridex)
ssdeep 12288:cwYQM2lWq8d6pwkoGnfwK0LkH7/umY06KrzzWUU3VACBET:RYgWRR0w74bbvIVAC
Threatray 118 similar samples on MalwareBazaar
TLSH T1C875D0126AE887CFC4376433582461B4F2DAB91784BC8F94DB86C30B5EEEAD4EC449D5
dhash icon 44b2686938d8cc00 (67 x Dridex)
Reporter Anonymous
Tags:Dridex exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
674
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
4583e87b6fc0bc83030af01bdfb800be4d3ee3807b22b28e263447ea2f863a36.dll
Verdict:
No threats detected
Analysis date:
2021-08-25 13:11:22 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/49e0c172-4fd5-4443-85a7-bceb08efde29

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/182323/
Detection(s):
Win.Packed.Dridex-9827808-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Changing a file
Replacing files
Creating a file
Creating a process from a recently created file
Deleting a recently created file
Creating a file in the %AppData% subdirectories
Sending a UDP request
Setting browser functions hooks
Forced shutdown of a system process
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Unauthorized injection to a system process
Unauthorized injection to a browser process
Forced shutdown of a browser
Enabling autorun by creating a file
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/705c1660-1088-4451-b2e6-ee4ab53276a2
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
64 / 100
Link:
https://www.joesandbox.com/analysis/839072
Signature
Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for submitted file
PE file has nameless sections
Queues an APC in another process (thread injection)
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 471516 Sample: QLC1PMThII.dll Startdate: 25/08/2021 Architecture: WINDOWS Score: 64 26 Antivirus / Scanner detection for submitted sample 2->26 28 Multi AV Scanner detection for submitted file 2->28 30 PE file has nameless sections 2->30 7 loaddll64.exe 1 2->7         started        9 explorer.exe 1 147 2->9         started        11 explorer.exe 2->11         started        process3 process4 13 rundll32.exe 7->13         started        16 cmd.exe 1 7->16         started        18 rundll32.exe 7->18         started        20 18 other processes 7->20 signatures5 32 Queues an APC in another process (thread injection) 13->32 22 explorer.exe 13->22 injected 24 rundll32.exe 16->24         started        process6
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4583e87b6fc0bc83030af01bdfb800be4d3ee3807b22b28e263447ea2f863a36/
Threat name:
Win64.Trojan.Injexa
Create hunting rule
Status:
Malicious
First seen:
2021-08-24 12:27:28 UTC
AV detection:
23 of 28 (82.14%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
dridex
Create hunting rule
Similar samples:
39aeb4b829dbaf57881874eb22330a8eb8440c9dc7dd49db912a0f05377a9c07
Dridex
3aa8b08faadabb153fc00fc7b9445feb34a75e040b1c0e734242b1f76a9dc6db
Dridex
3ddb6d9dde6a6d38745c271e6ff4b6c045beabafa2fe9a607ac7b183a51cb9cf
Dridex
62c3a9c66466f4bceff1f9d785b832af8f15f4ae1b07ec573ba2f43a0d7db308
Dridex
791fc1aa65ec3ae85a5441497344eed922c7e03720d086a58f17a63e038a6427
Dridex
9243b9644ef74212a00a79968b2f04c040824aeb470e7d3b4e76d57f1e415f2a
Dridex
9d941be63812c1b2be63a0bd33a8d8a84842ff19220f626039f783c2ef2e747e
Dridex
ca59948cbaec960d7b31ff1239c58d169b50dec11e57ab6201754362bf71b5fe
Dridex
d3096ae1aff66b900c5cc8e733e213cda2d01c55848aa8e91dec57f97cb95182
Dridex
d98e07cfa7163a044ebc9b5d16bd57ee54030941a9fc1564d76b2f6c655573e4
Dridex
+ 108 additional samples on MalwareBazaar
Result
Malware family:
dridex
Create hunting rule
Score:
  10/10
Tags:
family:dridex botnet evasion payload persistence trojan
Link:
https://tria.ge/reports/210825-hrs4vkvmks/
Behaviour
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of UnmapMainImage
Suspicious use of WriteProcessMemory
Adds Run key to start application
Checks whether UAC is enabled
Loads dropped DLL
Executes dropped EXE
Dridex Payload
Dridex Shellcode
Dridex
Unpacked files
SH256 hash:
4583e87b6fc0bc83030af01bdfb800be4d3ee3807b22b28e263447ea2f863a36
MD5 hash:
25d874573154be6d3d14ae6e97426536
SHA1 hash:
b1d9b15f13c242d449104978d9fa8541cb233188
Link:
https://www.unpac.me/results/c9afbe9c-1ab1-4c26-9151-0d39aa3ad6c4/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/4583e87b6fc0/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.75
Link:
https://yomi.yoroi.company/submissions/4583e87b6fc0bc83030af01bdfb800be4d3ee3807b22b28e263447ea2f863a36

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Dridex

Executable exe 4583e87b6fc0bc83030af01bdfb800be4d3ee3807b22b28e263447ea2f863a36

(this sample)

  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/182323/

Comments