MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 b313445cb24dc268ce189cd1b8265c37fe13e135990cdacde63708661b04d5e7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Dridex
Vendor detections: 10
| SHA256 hash: | b313445cb24dc268ce189cd1b8265c37fe13e135990cdacde63708661b04d5e7 |
|---|---|
| SHA3-384 hash: | f3415621e0a4b41e5e06c71a6cd42e2f545a6f26b906132a19e9e56849b15eb0d890660c23d7304c32959fb0d1607ea9 |
| SHA1 hash: | 15ede5a73a0422550df7a27ac8dabe2b18895eca |
| MD5 hash: | a7ac1595bfeb5786f4467d8c8f2b3405 |
| humanhash: | victor-jupiter-robin-montana |
| File name: | a7ac1595_by_Libranalysis |
| Download: | download sample |
| Signature | Dridex |
| File size: | 383'552 bytes |
| First seen: | 2021-05-06 00:01:37 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | 9da2ee6894aff5aadac7ad826cf07391 (1 x Dridex) |
| ssdeep | 6144:TxufKB2MPDhyH25IFTDwHGFenRJCPqRYZuQXTnnWdJ0mTS:TSKBnPDhYeGTDoXRJPRwuETnW8 |
| Threatray | 783 similar samples on MalwareBazaar |
| TLSH | D4840112E2798D73ECA509B1EC395F39A745EDB2433D68837AC4FA1CE13419A5C27B12 |
| Reporter |  Libranalysis |
| Tags: | Dridex |
Intelligence
File Origin
# of uploads :
1
# of downloads :
97
Origin country :
n/a
Vendor Threat Intelligence
Detection:
DridexLoader
Result
Verdict:
Malware
Maliciousness:
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Dridex
Detection:
malicious
Classification:
troj.evad
Score:
88 / 100
Signature
C2 URLs / IPs found in malware configuration
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found malware configuration
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Yara detected Dridex unpacked file
Behaviour
Behavior Graph:
Detection:
dridex
Threat name:
Win32.Infostealer.Dridex
Status:
Malicious
First seen:
2021-04-29 07:32:00 UTC
AV detection:
17 of 29 (58.62%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Label(s):
dridex
Similar samples:
+ 773 additional samples on MalwareBazaar
Result
Malware family:
dridex
Score:
10/10
Tags:
family:dridex botnet:10111 botnet loader
Behaviour
Dridex Loader
Dridex
Malware Config
C2 Extraction:
159.8.59.82:443
210.65.244.183:8443
188.40.137.206:8172
210.65.244.183:8443
188.40.137.206:8172
Unpacked files
SH256 hash:
2670fca792beee9e6a8e4104d15affe9b9f2fa65971d25d4b94b99265a863ac7
MD5 hash:
f45e6d54644eeb72bf5b23c11a649ac6
SHA1 hash:
17f51897a5e9d4b4586a301ec91b15ae11e05ae9
SH256 hash:
b313445cb24dc268ce189cd1b8265c37fe13e135990cdacde63708661b04d5e7
MD5 hash:
a7ac1595bfeb5786f4467d8c8f2b3405
SHA1 hash:
15ede5a73a0422550df7a27ac8dabe2b18895eca
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.============================================================
MBC behaviors list (github.com/accidentalrebel/mbcscan):
============================================================
0) [F0002.002] Collection::Polling