MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b0ebc236d8c390a4e4e4f03fc9cdc0bfadbc1c487777a40592015c016db09612. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Dridex


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b0ebc236d8c390a4e4e4f03fc9cdc0bfadbc1c487777a40592015c016db09612
SHA3-384 hash: 03e51331a6589d622fbc613e25847240012d2093b363a4cd084c891a8e3cb51259684b9a0d482768aef1307a6af89afc
SHA1 hash: 30d6116df771ef54d7f9e13eb77043bc414e23de
MD5 hash: 09951d905944e88076cb199e18500d18
humanhash: magnesium-purple-two-nebraska
File name:flpaoql.exe
Download: download sample
Signature Dridex
Create hunting rule
File size:200'704 bytes
First seen:2020-07-01 17:28:10 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 816bcf201d3f49fd80ec7c3514518b05 (4 x Dridex)
ssdeep 6144:kzvE37X0lCuqqmHyrYK7NiU3UXHaBCFug:ko3z+FmHyrDTU3oCFN
Threatray 95 similar samples on MalwareBazaar
TLSH B7140202B78DE0F1D6121074F406BB7DB312AEB174094F5AAF983A9DBF365509DB3606
Reporter abuse_ch
Tags:Dridex exe


Avatar
abuse_ch
Malspam distributing Dridex:

HELO: documents.24hrvetportorange.com
Sending IP: 45.140.18.86
From: Justina Claudie <reply@documents.24hrvetportorange.com>
Reply-To: leanne@irvines.ca
Subject: Past Due Invoice No. #618449
Attachment: 485022.xls

Dridex payload URL:
http://risweg.com/flpaoql.exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
133
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Detection(s):
SecuriteInfo.com.Generic.mg.118a0f8b8692456e.13265.UNOFFICIAL
Create hunting rule

Detection:
dridex
Create hunting rule
Link:
https://mwdb.cert.pl/sample/b0ebc236d8c390a4e4e4f03fc9cdc0bfadbc1c487777a40592015c016db09612/
Threat name:
Win32.Infostealer.Dridex
Create hunting rule
Status:
Malicious
First seen:
2020-07-01 17:30:06 UTC
AV detection:
24 of 28 (85.71%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=wdv4enwyyoikjzhe6a74ttoax6w3yhcio532ibmsafoac3nqsyja._file
Verdict:
suspicious
Similar samples:
10d2dca371bee5330d7ebcd022dbd1baddd3dc8ed4b3b602ce1efe333f79b9c9
Dridex
16236a7967ffcae726ad1c8fff934e7c852ea2216d28bd73f26beb4d74a30bc0
Dridex
4d7fd7d58f0bbd4318dfad6767b1046a25f9fc2915ca41b4763be74da56683a5
Dridex
4fae283ae2323e49f1a95871e773e3a2bfe54dc151cd7c11cbe41a36fd83bb14
Dridex
7543c6fd163cc67f5bf477b5b583bfca5c094e65c6a5d5dea56e3eeb333b1cad
Dridex
7629b2e44020de99d74665b6afb0877f1f9b192714302eff3a6b38f61f2d79f2
Dridex
c7d7e6c6dc477e5fdb2b2a26eed1b53e77d455dbec8df800927a5bae69a2cc10
Dridex
e5d4600354cad7a882caac33f0e18bc6702a269dab9315ef71835fbbad747626
Dridex
f072b971950ba8a2e12c85501f0d63160f833df8411c5fa1cda8ac6261b27a2d
Dridex
ffe5b585cebd48c48d45d315506f232f43b77761225cb349fe80e73bfb2485d5
Dridex
+ 85 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/200701-v8a36ql1k6/
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Dridex

Excel file xls 1463790facf513c8798815818a62d7decc55d535fc90189d6e4c0e8dd052d119

Dridex

Executable exe b0ebc236d8c390a4e4e4f03fc9cdc0bfadbc1c487777a40592015c016db09612

(this sample)

  
Dropped by
MD5 ac6e65dc7302c64a982e48e9d9691ab5
  
Dropped by
SHA256 1463790facf513c8798815818a62d7decc55d535fc90189d6e4c0e8dd052d119
  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/406837/
  
URLhaus
https://urlhaus.abuse.ch/url/406803/
Cape
Cape
https://www.capesandbox.com/analysis/17738/

Comments