MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b6061934972e541bf1f421f92c7342892661ebb98f75bd833b4c14ddbdd9291f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Dridex


Vendor detections: 7


Intelligence 7 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b6061934972e541bf1f421f92c7342892661ebb98f75bd833b4c14ddbdd9291f
SHA3-384 hash: 3548fa0b8e83677a25ede0b07dad709f382fd526cac3b290d51fa528a4447d9217ba4cabc9d0f4ea42a21043d044b66a
SHA1 hash: 4485cea69f77e0054d3bc75b7fa74ba4110f4333
MD5 hash: eafb12224f9a1b16fff806e40b252c5d
humanhash: johnny-floor-speaker-vermont
File name:DRIDEX (3)
Download: download sample
Signature Dridex
Create hunting rule
File size:327'680 bytes
First seen:2020-09-24 07:37:21 UTC
Last seen:2020-09-24 08:37:03 UTC
File type:DLL dll
MIME type:application/x-dosexec
imphash 0711eaedc93119f4fba09fc656e118ab (7 x Dridex)
ssdeep 3072:14LaiXGwW6f3ny73vo0FbxbqOwO42GLSGL5UUoIPjgbgba5ytyiqNTPmcvld2hJk:1BrwXy7wvxSGGJIPje15Tvld3s5pd
Threatray 34 similar samples on MalwareBazaar
TLSH F564E1113AE65929F6B36B708DBB05048F1F7E912C3C81CE86111B5A9A63640CFE7FB5
Reporter JAMESWT_WT
Tags:Dridex

Intelligence

File Origin
# of uploads :
2
# of downloads :
159
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Detection(s):
SecuriteInfo.com.Trojan.Dridex.735.23088.7285.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:
Result
Threat name:
Unknown
Detection:
malicious
Classification:
n/a
Score:
52 / 100
Link:
https://www.joesandbox.com/analysis/474066
Signature
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 289479 Sample: DRIDEX (3) Startdate: 24/09/2020 Architecture: WINDOWS Score: 52 10 Multi AV Scanner detection for submitted file 2->10 12 Machine Learning detection for sample 2->12 6 loaddll32.exe 1 2->6         started        process3 process4 8 WerFault.exe 3 9 6->8         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b6061934972e541bf1f421f92c7342892661ebb98f75bd833b4c14ddbdd9291f/
Threat name:
Win32.Infostealer.Dridex
Create hunting rule
Status:
Malicious
First seen:
2020-09-24 01:50:00 UTC
File Type:
PE (Dll)
AV detection:
23 of 29 (79.31%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
dridex
Create hunting rule
Similar samples:
147ebcc44853cc5a776a50bb099177d4d87e00960aec208d2283f0b0c8c08b99
Dridex
1f8dc085e250847f7a31d7785710be49b17eed1e1c6e460478e2e5232bda689a
Dridex
2c57cdeb1938688244dcaf05544e47daef28a6cec2866a674df9b6a4ed45237a
Dridex
3ab48ca45cd8a40aa0100279752afd3e89003bb85bf420c8b1be62e019f4c9eb
Dridex
8ae193225bd1a7192315a7003aa4aa9565c573b6078f48cc9e290c9b0798235e
Dridex
92794ce2b86f5636b0636952f7ac4b02f0fd664b5f479372d64aa779d376a7a2
Dridex
cd4ccf6b266b11aa29327444754c4c42f175725c4c03e21cf5dae151a4c4aa41
Dridex
d9405516d908f39043c9971884df73b57ae6db3002364444ec9b4e2a1d026ddb
Dridex
dd39accfa55be48b2c14f264a5917ead4964b8a7ce7f3f113cc74d13f87e86e7
Dridex
fd4159627ae84c3010c4fa3398c64d9639997d795338ab11fe2ad464f160b74e
Dridex
+ 24 additional samples on MalwareBazaar
Result
Malware family:
dridex
Create hunting rule
Score:
  10/10
Tags:
botnet loader family:dridex
Link:
https://tria.ge/reports/200924-vga9ehvcke/
Behaviour
Suspicious use of WriteProcessMemory
Dridex Loader
Dridex
Malware Config
C2 Extraction:
151.236.219.181:443
142.4.6.57:14043
162.144.127.197:3786
103.40.116.68:5443
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/b6061934972e541bf1f421f92c7342892661ebb98f75bd833b4c14ddbdd9291f

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Dridex

DLL dll b6061934972e541bf1f421f92c7342892661ebb98f75bd833b4c14ddbdd9291f

(this sample)

Cape
Cape
https://www.capesandbox.com/analysis/65265/
  
URLhaus
https://urlhaus.abuse.ch/url/609454/
  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/609466/
  
URLhaus
https://urlhaus.abuse.ch/url/609471/
  
URLhaus
https://urlhaus.abuse.ch/url/609472/

Comments