MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b40a11dcea513d7f8119735975a133c896592a804f003074e735015e35f43468. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Dridex


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b40a11dcea513d7f8119735975a133c896592a804f003074e735015e35f43468
SHA3-384 hash: dc8d00b68f7009afb8db64aa25d3d9b1bd0ba56e3fb8dfe9ed38412bca4be1cf97a30ccd115ac9d4cc7198724b958aa6
SHA1 hash: 947eabe7ca6771ef4ada58b62f8ae41abc20a5ae
MD5 hash: 42ae2a8d3808a7b9afb47f78825d45cc
humanhash: mike-nitrogen-jupiter-bacon
File name:M8kiSjNOkR.dll
Download: download sample
Signature Dridex
Create hunting rule
File size:167'936 bytes
First seen:2020-12-16 18:38:53 UTC
Last seen:2020-12-16 20:35:55 UTC
File type:DLL dll
MIME type:application/x-dosexec
imphash aaf3f8a7e0fdc202353c68c4c54c5a75 (22 x Dridex)
ssdeep 3072:D1V+vpDx7DUQrMrXxomqF0uMfbaqPR7sOdBvFBnBXit/ba82MnJI:RMXDUQrOqFXMzaqNs8vATa82M
Threatray 6 similar samples on MalwareBazaar
TLSH B0F3E11361C6EB7CDB2204B25CEE138DD1348D10CE797B1DA66D709AA7FAFD10A89352
Reporter ffforward
Tags:dll Dridex

Intelligence

File Origin
# of uploads :
2
# of downloads :
195
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.BehavesLike.Win32.Drixed.cc.6400.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Sending a UDP request
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Unknown
Detection:
suspicious
Classification:
n/a
Score:
21 / 100
Link:
https://www.joesandbox.com/analysis/564618
Signature
Machine Learning detection for sample
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 331401 Sample: M8kiSjNOkR.dll Startdate: 16/12/2020 Architecture: WINDOWS Score: 21 12 Machine Learning detection for sample 2->12 6 loaddll32.exe 1 2->6         started        process3 process4 8 WerFault.exe 3 9 6->8         started        10 WerFault.exe 3 9 6->10         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b40a11dcea513d7f8119735975a133c896592a804f003074e735015e35f43468/
Threat name:
Win32.Trojan.Drixed
Create hunting rule
Status:
Malicious
First seen:
2020-12-16 18:39:05 UTC
File Type:
PE (Dll)
Extracted files:
15
AV detection:
17 of 46 (36.96%)
Threat level:
  5/5
Verdict:
unknown
Similar samples:
07ef09d52046d7f370a8eb7a0058834eec30b59424d2a804bad3a1794e7c0f61
Dridex
35dc29c0132f1684fc8ed518f98d959bd982ef058b3ba24d8a23ea1507452621
Dridex
7eb170f9d34ad87ab2de388464d87041290fa7baacb2284d8ff02f358c46becd
Dridex
9290d818ef8373a1ba99a14b5982552648ea54fc9ed468019a1ab2a4f833e6a2
Dridex
e94e13000b458fea9b3da107479516b9f568dfeed7010747d1ab36d2ee363286
Dridex
f0ecc44eacafdb97e9a84785bbdcffce312393c0e219d27040b42a3d4c93f45e
Dridex
Result
Malware family:
dridex
Create hunting rule
Score:
  10/10
Tags:
family:dridex botnet loader
Link:
https://tria.ge/reports/201216-9g3ck1x146/
Behaviour
Suspicious use of WriteProcessMemory
Dridex Loader
Dridex
Malware Config
C2 Extraction:
172.86.186.22:3889
46.105.131.78:14431
103.244.206.74:33443
139.162.53.147:4443
Unpacked files
SH256 hash:
a17b13139e5091be4a2a166cb4b1db4fcba9f09a0258ccdd34f07aeb79800592
MD5 hash:
a9f59ab10c391060e1980157744b7d8b
SHA1 hash:
4d850eab49008de0d268937f7a1140b49aba313e
Link:
https://www.unpac.me/results/e8646f4a-bd1b-4271-9074-38155eda7f65/
SH256 hash:
b087ecd864078c49e02d43814d841d6c067ba741341483d9c58cba949fa8a57b
MD5 hash:
c596bcc0b81290429e95e80bc3d1163c
SHA1 hash:
50fd69c49784f20742ec9a983c6888a7259d8834
Detections:
win_dridex_auto
Create hunting rule
Link:
https://www.unpac.me/results/e8646f4a-bd1b-4271-9074-38155eda7f65/
Parent samples :
b40a11dcea513d7f8119735975a133c896592a804f003074e735015e35f43468
0f1016beea87c7d751aff9f5ed596b452fdbd3bd9fb5405b76fa62014d89d54b
2542d8801568e29aef85b91ee8ea89ce20bfbbb46954941745c88f68d6c9eb20
09d4beff6b8ac12cc58777c675984ee929a260431741612048ac25f4341b753e
0263af7724d2ce102b22d81a54acece688022d99521b094068459f4bc4f6aca0
98f223299305b1c6994bd7ec18fbc0fc09260fc8bd542d02686e715769ed1fae
9c29b1e8d9212da8dd9ed375d5722ceabf65c13fab3c12c9c258530b38630628
db05b73f6963ec3d5bbaebbde3545dd801b79a54a41d583146a556b0f4505515
1670a34f9c0f49e6ba51de133293371ef77aa21442aaf4698eac0163ec68ff2e
94d02d97cf6989fbdb3010543f747751dc6ff9709c854323c7959a386bad43d3
2e8384b979521ab1a3ac17745f81d9a18fa084294d242d4a6918db4413e313c6
ed8e649fba97f6ef44c5ae7b5dc4c57d71aa28ea60063986f9edb9a0338d2748
1a13b0a4251771ac84bff5b2009e1fbd8eb2c8fdbd1299ba64299f40a2ad0e7d
a8289357cdb5e5a75f6d8e6fea9e74863f16e51c913123bd7cc442e818f258b6
b1c5f8455b82ed52709846267e516590c9e97019fe406691eb5b100e45e3bd78
a81a824a4030808e0998064a90a4905fa87808e46f75c0c8d38a8f771a0d3288
2cb94e38a1930e97de56e8a310155f8b98f4effa7ffd5e3553bec6f5f9539fb2
eac020aa33b9585b92e202a58b1924b1b628a7cad2d39236b423110c221fa481
ac0e2a63a741fe311d13210f830d6995ade78652b6705420d1c382cd8a825eab
88813cbb3272347ca08a88e9ce1064bfdaf317d564c8c22c377f18a6e6fa2618
84f85c52fe3defb96af28e575a590505991fcdb447a30825d9e4d3d6b1eaaf0f
0ca4f84f42c000128a1451ffafb83a1bc482fcb79dc5ff4a4b1263d7a9313391
SH256 hash:
b40a11dcea513d7f8119735975a133c896592a804f003074e735015e35f43468
MD5 hash:
42ae2a8d3808a7b9afb47f78825d45cc
SHA1 hash:
947eabe7ca6771ef4ada58b62f8ae41abc20a5ae
Link:
https://www.unpac.me/results/e8646f4a-bd1b-4271-9074-38155eda7f65/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Trojan
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/b40a11dcea513d7f8119735975a133c896592a804f003074e735015e35f43468

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Dridex

Word file doc 9461d075ec5d9590058e8623dded5d08da956a523f4806f2eb0567097a5d075b

Dridex

DLL dll b40a11dcea513d7f8119735975a133c896592a804f003074e735015e35f43468

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/923577/
  
Dropped by
SHA256 9461d075ec5d9590058e8623dded5d08da956a523f4806f2eb0567097a5d075b
  
Delivery method
Distributed via web download

Comments