🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5188398a523a59bb95068adcfd096082f5ef204dbc572ee09fa09e2da2bc9dd9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Dridex


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5188398a523a59bb95068adcfd096082f5ef204dbc572ee09fa09e2da2bc9dd9
SHA3-384 hash: e22ccd71f89641051b2e4452172b4355a62d7fedb54a6b2578a20685cf9857a2af2466261903bf2f4e86d33d7b688c59
SHA1 hash: a6cabe3526048b99af4be67942b9295ebafaa8f7
MD5 hash: 5542dadef8391b4c1252814b9547d847
humanhash: timing-stairway-gee-summer
File name:2qoGf0VX94dTFYv
Download: download sample
Signature Dridex
Create hunting rule
File size:204'800 bytes
First seen:2020-12-15 14:06:33 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash a23873606d43d18aeb728673d0ce4249 (15 x Dridex, 1 x Gozi)
ssdeep 3072:JFsIcCVMdHhbwlilXv+/dw7NN24M/1Z/NHPp6Yyb5RmShVo2D:JF32hXYd6rrM9BNCNYS
Threatray 36 similar samples on MalwareBazaar
TLSH DE149E41ABB60119F5FA073139FE79640AB57C094934FF5E3342B1ABAE39BD088947B1
Reporter JAMESWT_WT
Tags:Dridex

Intelligence

File Origin
# of uploads :
1
# of downloads :
266
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/108159/
Detection(s):
SecuriteInfo.com.Generic.mg.cdbc398cb79b82eb.5282.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Sending a UDP request
Result
Threat name:
Unknown
Detection:
clean
Classification:
n/a
Score:
2 / 100
Link:
https://www.joesandbox.com/analysis/563275
Behaviour
Behavior Graph:
n/a
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/5188398a523a59bb95068adcfd096082f5ef204dbc572ee09fa09e2da2bc9dd9/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2020-12-15 14:07:11 UTC
File Type:
PE (Dll)
Extracted files:
29
AV detection:
13 of 48 (27.08%)
Threat level:
  5/5
Verdict:
unknown
Similar samples:
0c0a849067910325d3a8d5a6fc5ee0e24f418e6ea2e2ac0a91f93b6c81b25434
Dridex
25ca541958b7124f79002d471a96d08c3b6cd4b28320ebf344f0330169d80d9a
Dridex
4d5f2df879408856825785fe3a63a6a119d7f617f4fc52243fc060d2708bf993
Dridex
662c21ee2aab3a65de038e9d1d3765093c2dddb0eb4a6ed73799b074f74bb8b9
Dridex
69f0200223c9d03d6150c4d0e5bab6dd5654618400716a84a61dc018dc61e57f
Dridex
ac9bdf7234d6fdcb50f8be07e0eadbcec5e07e028aa44d85cda6805a24d86e62
Dridex
de493b91b51601c878181a3e20235e5e592109d887df190293c0de094519f817
Dridex
e94e13000b458fea9b3da107479516b9f568dfeed7010747d1ab36d2ee363286
Dridex
eb3154fc479e6ec838bffbf7cb1f4247c4286625e2311bf6ba50abf7a48044a1
Dridex
fd4159627ae84c3010c4fa3398c64d9639997d795338ab11fe2ad464f160b74e
Dridex
+ 26 additional samples on MalwareBazaar
Result
Malware family:
dridex
Create hunting rule
Score:
  10/10
Tags:
family:dridex botnet loader
Link:
https://tria.ge/reports/201215-cw6rfn3kxe/
Behaviour
Suspicious use of WriteProcessMemory
Dridex Loader
Dridex
Malware Config
C2 Extraction:
77.220.64.37:443
85.25.144.36:4643
51.15.176.55:3389
139.162.53.147:4443
Unpacked files
SH256 hash:
5188398a523a59bb95068adcfd096082f5ef204dbc572ee09fa09e2da2bc9dd9
MD5 hash:
5542dadef8391b4c1252814b9547d847
SHA1 hash:
a6cabe3526048b99af4be67942b9295ebafaa8f7
Link:
https://www.unpac.me/results/f1e0047b-7b47-43e3-b10a-79094300a782/
SH256 hash:
7f37e36a14913fd59bbc62448dc8337ad49cae54d6a6f18eec578019b6bcf383
MD5 hash:
9bf3f958476e5ffe5f07870ef1c8f71e
SHA1 hash:
72ef69ae0c2ee61290364575da02a032024a7b9a
Link:
https://www.unpac.me/results/f1e0047b-7b47-43e3-b10a-79094300a782/
SH256 hash:
786d3bac534c2ac628e64b7c691b63e1d216fa188e3a64afa1c0eb5c559db318
MD5 hash:
8f176b11a13202271b1a89240844441b
SHA1 hash:
0956bd680f64b343538760fd5a1a228d4ab8446f
Detections:
win_dridex_auto
Create hunting rule
Link:
https://www.unpac.me/results/f1e0047b-7b47-43e3-b10a-79094300a782/
Parent samples :
4d5f2df879408856825785fe3a63a6a119d7f617f4fc52243fc060d2708bf993
eb3154fc479e6ec838bffbf7cb1f4247c4286625e2311bf6ba50abf7a48044a1
786d3bac534c2ac628e64b7c691b63e1d216fa188e3a64afa1c0eb5c559db318
0c0a849067910325d3a8d5a6fc5ee0e24f418e6ea2e2ac0a91f93b6c81b25434
12b51b1bb3f57abdd5ddff5a2c86dd416d12669d85c1a999a419de5195e8f46d
119c6a4fbc1df623f74334c646cdd3444916427eacdb3d9222be9f758017492d
c0b724f92582625dc7bc44c89ce1fda666b52dbcec3c78228da762822fc58e49
330e60400c9e8c9ce5261540d31fb346d4a874eddee5040e465a03b368facb41
5188398a523a59bb95068adcfd096082f5ef204dbc572ee09fa09e2da2bc9dd9
0d271154fc1009f8f0034bbda517dc5f188a99100d6ef8a5827319b3ea30afff
25ca541958b7124f79002d471a96d08c3b6cd4b28320ebf344f0330169d80d9a
9723745ac74305a2b053a8b775bcf6f286786f8125af27752198a785877a2389
4280c27f9e3a0dae47929420089498fbef465f2daf892e7ddb04e1395c87cee4
99d8c0a7a6f68abe97bea4001cb14850de35ea9b0b35e2c40956b2f30595f378
9591987a6dcacd5edeeb4374628c09f8674bec41fa5beb0969bf2eeb10f7707c
041edba5ccd1c771382c57e623f3393248fd4c6cd86822a99061a571a531d1b9
03a4a28ccf750c1be52da2e87c729a26fe48c72007e03aba045ffd2a617c3a8e
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.80
Link:
https://yomi.yoroi.company/submissions/5188398a523a59bb95068adcfd096082f5ef204dbc572ee09fa09e2da2bc9dd9

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/108159/

Comments