MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 8d00cb0248e3933ec12d2e303c058d0dd83eea88fc9191c4ad6a9afaeeb092dd. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Dridex
Vendor detections: 5
| SHA256 hash: | 8d00cb0248e3933ec12d2e303c058d0dd83eea88fc9191c4ad6a9afaeeb092dd |
|---|---|
| SHA3-384 hash: | da9aef6661cc75339465f41f29762ef88f723f462762a09fbd8338082dd6c4d463de98573a8c6d3db09a224dd88d61a4 |
| SHA1 hash: | 586789de608e94f7df58d693a794e4cf8ed16d01 |
| MD5 hash: | af6bb7c9e0bc2da2228ed0f5891c27d9 |
| humanhash: | fanta-football-romeo-queen |
| File name: | 81z0m.dll |
| Download: | download sample |
| Signature | Dridex |
| File size: | 204'800 bytes |
| First seen: | 2020-12-21 19:51:21 UTC |
| Last seen: | 2020-12-21 21:39:37 UTC |
| File type: |  dll |
| MIME type: | application/x-dosexec |
| imphash | ff4887da2f409d7cc45957b36b659281 (2 x Dridex) |
| ssdeep | 3072:74jjoaPs7Our2PG+z9axt25Oer1XNPVscXKIXtpKvOj0uYOx2Ju:WjoH2++zlxVX7+2bh |
| Threatray | 41 similar samples on MalwareBazaar |
| TLSH | 6E14BD02EFA72B00FC2706FF58DC45525C31BC228932E96AA5D3379A65FDA178F50369 |
| Reporter | Anonymous |
| Tags: | Dridex |
Intelligence
File Origin
# of uploads :
2
# of downloads :
264
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Detection(s):
Result
Verdict:
Clean
Maliciousness:
Behaviour
Sending a UDP request
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Unknown
Detection:
suspicious
Classification:
n/a
Score:
22 / 100
Signature
Machine Learning detection for sample
Behaviour
Behavior Graph:
Threat name:
Win32.Trojan.Generic
Status:
Suspicious
First seen:
2020-12-21 19:52:06 UTC
AV detection:
16 of 48 (33.33%)
Threat level:
5/5
Verdict:
unknown
Similar samples:
+ 31 additional samples on MalwareBazaar
Result
Malware family:
dridex
Score:
10/10
Tags:
family:dridex botnet loader
Behaviour
Suspicious use of WriteProcessMemory
Dridex Loader
Dridex
Malware Config
C2 Extraction:
51.75.24.85:443
213.202.229.72:3074
202.91.8.121:4643
195.231.69.151:3889
213.202.229.72:3074
202.91.8.121:4643
195.231.69.151:3889
Unpacked files
SH256 hash:
8d00cb0248e3933ec12d2e303c058d0dd83eea88fc9191c4ad6a9afaeeb092dd
MD5 hash:
af6bb7c9e0bc2da2228ed0f5891c27d9
SHA1 hash:
586789de608e94f7df58d693a794e4cf8ed16d01
SH256 hash:
1b2706df2394c16886a8ff52289aa4550fe51d17da91c7d99da8b066179cdfda
MD5 hash:
c43662638a3b1d244ac1b6b3db1fb41a
SHA1 hash:
91ed69ef8afe49d23fb83d58083d291188e4ca7c
SH256 hash:
5599afc1f78db4e3d974434487fb3af1527d9688b3e01d90433cc0d7104855c7
MD5 hash:
d7f65036d4c0e330a3a4c5306fdaf6dd
SHA1 hash:
0661d575eac702962097448e6e5f2e589ac020b3
Detections:
win_dridex_auto
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.24
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.