MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7359fb03e09c8416c7a967f72df483a1b60066434c9e49e0deb4b18cb11e9192. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Dridex


Vendor detections: 8


Intelligence 8 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7359fb03e09c8416c7a967f72df483a1b60066434c9e49e0deb4b18cb11e9192
SHA3-384 hash: 9b5ac0d595f72166a09c40e7d61507bcbcca57d5c6d522881f5af25180c34a86b7639a7a4fe1ac11552597f721efcef8
SHA1 hash: db853d8f738ee15172141315e96644bf6f265d6b
MD5 hash: 19473a4823afb3ca1c966ffed1ee6003
humanhash: eighteen-angel-uranus-xray
File name:j4r7zap
Download: download sample
Signature Dridex
Create hunting rule
File size:552'448 bytes
First seen:2020-11-19 13:33:43 UTC
Last seen:2020-11-19 15:13:34 UTC
File type:DLL dll
MIME type:application/x-dosexec
imphash 18cb5c18face4302b794af9a2931a4bc (7 x Dridex, 1 x Gozi)
ssdeep 6144:AkF19P2yLnafTR93YBgobwN+5AxtyTCjzVm8NsCu6:AkFne883YdbY+5QyTE1k
Threatray 155 similar samples on MalwareBazaar
TLSH 8EC46102FCA74F5BD623127B24C660406D0ADC8C5F48E487A3A7F57492B73F46DE926A
Reporter JAMESWT_WT
Tags:dll Dridex

Intelligence

File Origin
# of uploads :
2
# of downloads :
145
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
Malware
Maliciousness:
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Unknown
Detection:
malicious
Classification:
n/a
Score:
52 / 100
Link:
https://www.joesandbox.com/analysis/542957
Signature
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/7359fb03e09c8416c7a967f72df483a1b60066434c9e49e0deb4b18cb11e9192/
Threat name:
Win32.Trojan.Ursnif
Create hunting rule
Status:
Malicious
First seen:
2020-11-19 13:34:04 UTC
File Type:
PE (Dll)
Extracted files:
5
AV detection:
26 of 28 (92.86%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=onm7wa7atscbnr5jm73s35edug3aazsdjspetyg6wsyyzmi6sgja._file
Verdict:
malicious
Label(s):
dridex
Create hunting rule
Similar samples:
0dfab637891eaf6ff9134a21c5200d677f6e915a25b43e8a4acc5fe90f793033
Dridex
3a051adde831c2fd025774dfa237db5b442bc654eceacf99b3b6aec7092a29da
Dridex
4bbf766e8ac0148b77e659e3a3cfd110c6f219468c240987874c03107b4f8826
Dridex
6d5ca5fcaba6a6558013344ff5f11328e8079540e8ebe95789d9c185e11f8e44
Dridex
77419f5d237715b7664ae53e806dea7465cdb6159f76a462fc31fcd731db5f2b
Dridex
881c022032c6fb9bedfae76dd6c93863b2b7f48e282e0dbcbdcf702a6958ced2
Dridex
8880aa45619f26fcb4cca6671e7decc6dcf94163344a819a156ed9f5bd414d0b
Dridex
8cc5a65a8206e82d93604182bb6cd7f72e08a6b45cdf07e6479e493457c0ab12
Dridex
af3c57b18d35f88f076c5b15fd7cc814d4e7724037158d7e5a3facf9bece3d26
Dridex
eb1a0c3677f4b416e43e2c4d88a30d1f5bd4d9b00b1e0c48efef31b034465e3c
Dridex
+ 145 additional samples on MalwareBazaar
Result
Malware family:
dridex
Create hunting rule
Score:
  10/10
Tags:
family:dridex botnet discovery evasion loader trojan
Link:
https://tria.ge/reports/201119-g2vmpr2nqj/
Behaviour
Suspicious use of WriteProcessMemory
Checks installed software on the system
Checks whether UAC is enabled
Blacklisted process makes network request
Dridex Loader
Dridex
Malware Config
C2 Extraction:
162.241.44.26:9443
192.232.229.53:4443
77.220.64.34:443
193.90.12.121:3098
Unpacked files
SH256 hash:
7359fb03e09c8416c7a967f72df483a1b60066434c9e49e0deb4b18cb11e9192
MD5 hash:
19473a4823afb3ca1c966ffed1ee6003
SHA1 hash:
db853d8f738ee15172141315e96644bf6f265d6b
Link:
https://www.unpac.me/results/a573da4c-eae8-420f-93b1-7060c0d06b53/
SH256 hash:
11e755c9d1a5ea74dfc765a2f44eb7c3bbc2d735fcf2489882ede6aeb0816493
MD5 hash:
180230a6ffbbf57a370da06c41b26cf1
SHA1 hash:
2f25b00b16544615b766e5efd10555797177f29a
Link:
https://www.unpac.me/results/a573da4c-eae8-420f-93b1-7060c0d06b53/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/7359fb03e09c8416c7a967f72df483a1b60066434c9e49e0deb4b18cb11e9192

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Dridex

DLL dll 7359fb03e09c8416c7a967f72df483a1b60066434c9e49e0deb4b18cb11e9192

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/832926/
  
Delivery method
Distributed via web download

Comments