MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4fae283ae2323e49f1a95871e773e3a2bfe54dc151cd7c11cbe41a36fd83bb14. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Dridex


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4fae283ae2323e49f1a95871e773e3a2bfe54dc151cd7c11cbe41a36fd83bb14
SHA3-384 hash: 81e2699d999dc5139bfdef201288bc5925bc357d8188c58f6c2658ec1912f64c2605636603e131cbad84e012b0b7a98f
SHA1 hash: 8fe3a47bda61cf9bd25507e6ef1a330604c17d59
MD5 hash: 6b9dc48015c09a77367dbad4a6fd41b8
humanhash: glucose-one-coffee-spring
File name:6b9dc48015c09a77367dbad4a6fd41b8.exe
Download: download sample
Signature Dridex
Create hunting rule
File size:245'760 bytes
First seen:2020-05-12 16:20:33 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 838d09ab32f92a82bd3ee8cfed69ffe0 (2 x Dridex)
ssdeep 6144:FQTpcTG6P4QPrApDAeDrzTLnUEudn2G7I99:FQ8HgQD2AeXoFnB72
Threatray 100 similar samples on MalwareBazaar
TLSH 8934BE62A7F9A605F5F36F716CBA16844E3ABD929C39C60D2340254D4DB6F80DE60B33
Reporter abuse_ch
Tags:Dridex exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
116
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/3295/
Detection(s):
SecuriteInfo.com.Generic.mg.6b9dc48015c09a77.3541.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Dridex
Create hunting rule
Status:
Malicious
First seen:
2020-05-11 21:04:21 UTC
File Type:
PE (Exe)
AV detection:
26 of 31 (83.87%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=j6xcqoxcgi7et4njlby6o47duk76ktobkhgxyeol4qndn7mdxmka._file
Verdict:
malicious
Label(s):
dridex
Create hunting rule
Similar samples:
043da6ea28e1ae44078f4941c3e7db3c63566f4b312121bd3f81b6b3cec0e8d7
Dridex
055f7e7b22e851afae09773a609a4f354e2dd8455b2eaf2301eb3d8701b60936
Dridex
110fe6f199298f89f704050eb4dc0d2b19b0985a74ead588441fabac693ab3f5
Dridex
4160e31c01e1c9fbad1e737efb974a0cb35721023607e831292c26873bdee4db
Dridex
55897dc537d308842906dbf8bffde6eb846cdd6b5e9584d7efcbe7c342d5e699
Dridex
6d0c9ea95d779737b7e9ea2a838a0efede90f1d3c6ce91943e65067a82631b81
Dridex
a84a6fde4dbc4575700b8be705ed1df6d576e5aa6054aa66f1fae98350484a84
Dridex
c4f35b00490a1875286701b5909053c04668e4ec09da8e4ecd7405a3c136d6b0
Dridex
c6a810bf84ea3fd17a282d2a10bec7811c79ff751d5dbcf9eb84cff95f1fd5ba
Dridex
f072b971950ba8a2e12c85501f0d63160f833df8411c5fa1cda8ac6261b27a2d
Dridex
+ 90 additional samples on MalwareBazaar
Result
Malware family:
dridex
Create hunting rule
Score:
  10/10
Tags:
family:dridex botnet loader
Link:
https://tria.ge/reports/201109-n6qs4a5fnx/
Behaviour
Dridex Loader
Dridex
Malware Config
C2 Extraction:
178.128.83.136:443
138.122.143.41:8443
85.25.106.204:691
159.203.136.67:3308
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Dridex

Executable exe 4fae283ae2323e49f1a95871e773e3a2bfe54dc151cd7c11cbe41a36fd83bb14

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/361218/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/3295/
Cape
Cape
https://www.capesandbox.com/analysis/3293/
Cape
Cape
https://www.capesandbox.com/analysis/3291/

Comments