MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 abc00bed0b42c8f67a598d1f858dd33e112ff04e0addfbf8f6f554a6b6eee54c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Dridex

Vendor detections: 7

Intelligence 7 IOCs YARA 2 File information Comments

SHA256 hash:	abc00bed0b42c8f67a598d1f858dd33e112ff04e0addfbf8f6f554a6b6eee54c
SHA3-384 hash:	424468dce400f576cd928737fa73f18984112dc45b0868b2ea1b74f1aa171e025c229765330ba5b3c4f1fa152ef28ebd
SHA1 hash:	b2f19c153b41ad9969dbfd9ed0a0b46b1330a7ff
MD5 hash:	4fa396905538cf2975dda3aee5c466a4
humanhash:	wyoming-glucose-glucose-ack
File name:	4fa396905538cf2975dda3aee5c466a4.dll
Download:	download sample
Signature	Dridex Create hunting rule
File size:	397'824 bytes
First seen:	2020-10-22 16:57:30 UTC
Last seen:	Never
File type:	dll
MIME type:	application/x-dosexec
imphash	1110d92e74a89911b72f674bfa327447 (1 x Dridex)
ssdeep	6144:1xI2j28bm2WJHEII+buAqQxZt4995XkN6y1Ya5PDlHPspG:eRJku/L05dyVrvn
Threatray	26 similar samples on MalwareBazaar
TLSH	47849E2016B3F99AF6796275BAD72CA5F19C47A829583C1BDD7388821A46337F4C430F
Reporter	abuse_ch
Tags:	dll Dridex

Intelligence

File Origin

# of uploads :

# of downloads :

105

Origin country :

n/a

Vendor Threat Intelligence

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/74743/

Result

Verdict:

Malware

Maliciousness:

Behaviour

Sending a custom TCP request

Result

Threat name:

Unknown

Detection:

malicious

Classification:

n/a

Score:

52 / 100

Link:

https://www.joesandbox.com/analysis/507517

Signature

Machine Learning detection for sample

Multi AV Scanner detection for submitted file

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/abc00bed0b42c8f67a598d1f858dd33e112ff04e0addfbf8f6f554a6b6eee54c/

Threat name:

Win32.Infostealer.Dridex

Status:

Malicious

First seen:

2020-10-22 09:47:23 UTC

AV detection:

24 of 29 (82.76%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=vpaax3ililepm6szrupyldothyis74coblo7x6hw6vkknnxo4vga._file

Verdict:

malicious

Label(s):

dridex

Result

Malware family:

dridex

Score:

10/10

Tags:

botnet loader discovery family:dridex evasion trojan

Link:

https://tria.ge/reports/201022-l4gr5rttv2/

Behaviour

Suspicious use of WriteProcessMemory

Checks installed software on the system

Checks whether UAC is enabled

Blacklisted process makes network request

Dridex Loader

Dridex

Malware Config

C2 Extraction:

194.150.118.7:443
45.77.154.161:1688
45.56.127.75:49160
62.171.142.179:4664

Unpacked files

SH256 hash:

abc00bed0b42c8f67a598d1f858dd33e112ff04e0addfbf8f6f554a6b6eee54c

MD5 hash:

4fa396905538cf2975dda3aee5c466a4

SHA1 hash:

b2f19c153b41ad9969dbfd9ed0a0b46b1330a7ff

Link:

https://www.unpac.me/results/30a72321-36de-4a47-9b5e-1340a0525224/

SH256 hash:

3cc029e98092f860613fdf49ae918d5ea20c7d37a51295b0f16a536311531944

MD5 hash:

b0a6ad1e2daac1276d523926e32a84fd

SHA1 hash:

4a2500099f95c444059c8a0f0980914032adedf0

Link:

https://www.unpac.me/results/30a72321-36de-4a47-9b5e-1340a0525224/

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.