MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ab44ef41e492f3df1be566ddde081d666b3e9f55ee6f0f195fe0acd4d9701912. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Gozi


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ab44ef41e492f3df1be566ddde081d666b3e9f55ee6f0f195fe0acd4d9701912
SHA3-384 hash: 613ded1c26a43cf7eddcd8c8658d1486dcba98d1a6c2333fdce42cc95b0740979a3a9b115a82dcfddda0c31031437649
SHA1 hash: b7770117dd745c464a40bd3d3eda0ca832ec34a5
MD5 hash: 8b0192345666026191be01ec52a47f64
humanhash: bulldog-uranus-arizona-ink
File name:11046515.dll
Download: download sample
Signature Gozi
Create hunting rule
File size:647'168 bytes
First seen:2020-05-11 13:57:20 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash 87b16955b2aa167327f4d4229e828bd3 (2 x Gozi)
ssdeep 12288:68+VK2ho/zExjnvSBvHtQC1H7aK5AEsAQvE86tSO2UxTXN2sigeeERhiXaiuYV1Q:68+VKmoqv4tQkJQvE8mSO2UxTXQsige8
Threatray 62 similar samples on MalwareBazaar
TLSH 04D44B10364DE238C9A902329C56F6FC01797E1DEF125E1B77EA3F4FF6B05418969A0A
Reporter James_inthe_box
Tags:dll Gozi

Intelligence

File Origin
# of uploads :
1
# of downloads :
77
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Packer.PrivateExeProte-11
Create hunting rule

PUA.Win.Downloader.Aiis-6803892-0
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Dridex
Create hunting rule
Status:
Malicious
First seen:
2020-05-11 13:57:32 UTC
File Type:
PE (Dll)
AV detection:
21 of 31 (67.74%)
Threat level:
  2/5
Verdict:
malicious
Label(s):
dridex
Create hunting rule
gozi
Create hunting rule
Similar samples:
0a383870010db689605e8aac2fd1a9ad284558ef9eccc6d07bdc9dbbc573480f
Gozi
19042ea0e61783a3c281e3f02e0e2e2b07e9421bae0afeeae21febe450510f0c
Gozi
4655c0216538f752dea2ce1649807d597cd83a935f1385bdd8f418616de97b68
Gozi
5ade0c4492ffe4b77776543635a5cad0eef6d4a207f69dac0a59f9ad76aa42ba
Gozi
75d79cd50c0f3def32be69db58e716d7094006636c8ff9479254ff34224d327e
Gozi
d3e9f6933d519b6bd1514ceaaa14df64722214c0c6c2a60a6924c92f284b3c08
Gozi
d77234374d79b24022c26ecdd16a684ae7e94efba502422d74852b0eddd4f1b4
Gozi
e9880c5c608141c8ec12ce1a8d14652731583e4055f74ce2727afe8c3ea15cb6
Gozi
f32072d7d581e1a8d04c47b21dafadd58e3dccc3aa0188d7f95f6867944475e0
Gozi
fcd9abcb235ec7aea9a425394952653a57b44ba9233e934289d2b6892fac82b2
Gozi
+ 52 additional samples on MalwareBazaar
Result
Malware family:
dridex
Create hunting rule
Score:
  10/10
Tags:
family:dridex botnet discovery evasion loader trojan
Link:
https://tria.ge/reports/201109-226zbskye6/
Behaviour
Suspicious use of WriteProcessMemory
Checks installed software on the system
Checks whether UAC is enabled
Blacklisted process makes network request
Dridex Loader
Dridex
Malware Config
C2 Extraction:
178.128.83.136:443
138.122.143.41:8443
85.25.106.204:691
159.203.136.67:3308
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other

Comments