MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 60ecc4196ae1408d87efec39e290a8b497afd872f760b091170d018ac6f550de. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Dridex


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 60ecc4196ae1408d87efec39e290a8b497afd872f760b091170d018ac6f550de
SHA3-384 hash: 9a1402b44caacdc9aa241e15c93ae4c0c7715d8e026c5f193df5fb4770d37763d0cdec73548776fff0fd430d0e026b86
SHA1 hash: 4ad30eb9dced6fa8893bf134cefcc5415f0d08e6
MD5 hash: 3a8758fb007282f84210444f73f98d3f
humanhash: blossom-stairway-ceiling-connecticut
File name:3a8758fb007282f84210444f73f98d3f.dll
Download: download sample
Signature Dridex
Create hunting rule
File size:262'144 bytes
First seen:2021-03-02 17:55:49 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
ssdeep 3072:q3suENzlgB8vR8FwrSefuCJoxyGKbkQptoBEfjwB3Zv8HYMG5bT76W8+R+iS1ict:YLExaqvRuqh931pIwuZ0/GBzqii
TLSH 9A44BE45F269C1E7E46490BEED41C6FD9AC57C81DC28D863B8DB2F1FB42F500A992236
Reporter abuse_ch
Tags:dll Dridex

Intelligence

File Origin
# of uploads :
1
# of downloads :
220
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/121115/
Detection(s):
SecuriteInfo.com.Heur.Corrupt.PE@1z141z3.11007.29926.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
Result
Verdict:
SUSPICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Unknown
Detection:
malicious
Classification:
n/a
Score:
52 / 100
Link:
https://www.joesandbox.com/analysis/624557
Signature
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 361272 Sample: AZkBLqL735.dll Startdate: 02/03/2021 Architecture: WINDOWS Score: 52 34 Multi AV Scanner detection for submitted file 2->34 36 Machine Learning detection for sample 2->36 14 loaddll32.exe 1 2->14         started        process3 process4 16 rundll32.exe 14->16         started        process5 18 rundll32.exe 16->18         started        process6 20 rundll32.exe 18->20         started        process7 22 rundll32.exe 20->22         started        process8 24 rundll32.exe 22->24         started        process9 26 rundll32.exe 24->26         started        process10 28 rundll32.exe 26->28         started        process11 30 rundll32.exe 28->30         started        process12 32 rundll32.exe 30->32         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/60ecc4196ae1408d87efec39e290a8b497afd872f760b091170d018ac6f550de/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=mdwmiglk4fai3b7p5q46fefiwsl27wds65qlbeixbuayvrxvkdpa._file
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/210302-9dcen63x96/
Behaviour
Suspicious use of WriteProcessMemory
Unpacked files
SH256 hash:
60ecc4196ae1408d87efec39e290a8b497afd872f760b091170d018ac6f550de
MD5 hash:
3a8758fb007282f84210444f73f98d3f
SHA1 hash:
4ad30eb9dced6fa8893bf134cefcc5415f0d08e6
Link:
https://www.unpac.me/results/e6f088e8-543f-48e6-bca0-449216387635/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Dridex
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/60ecc4196ae1408d87efec39e290a8b497afd872f760b091170d018ac6f550de

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Dridex

DLL dll 60ecc4196ae1408d87efec39e290a8b497afd872f760b091170d018ac6f550de

(this sample)

Cape
Cape
https://www.capesandbox.com/analysis/121115/
  
URLhaus
https://urlhaus.abuse.ch/url/1040527/
  
Delivery method
Distributed via web download

Comments