MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 bf1e36ac51a1a92eb6b5f4c68b67dfccc0692841d73045136cb9d7bc53bcf46d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Dridex
Vendor detections: 6
| SHA256 hash: | bf1e36ac51a1a92eb6b5f4c68b67dfccc0692841d73045136cb9d7bc53bcf46d |
|---|---|
| SHA3-384 hash: | 494760d55439d7ad76ee3b2bce3201d8548c6221f4c0528107a64595eb7614094e44d9147af1c5268ac803939d08a93e |
| SHA1 hash: | 8c6a82794b4c794fccce7a8c177551d4032945ff |
| MD5 hash: | b7304a0ce5f2732a115d1cc850eab13c |
| humanhash: | four-solar-kilo-six |
| File name: | kg2v1lpdf |
| Download: | download sample |
| Signature | Dridex |
| File size: | 221'184 bytes |
| First seen: | 2020-11-24 08:55:37 UTC |
| Last seen: | 2020-11-24 18:19:14 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | 5da19dcc64b843868370fc6bfebaf47e (3 x Dridex) |
| ssdeep | 3072:PUKnIavARia3SsHlptUEb1Z+MfYwbKLIMr2b7XFTfnyrvsherh:PrnvvARmsH1Zxfzmv2vFTarL |
| Threatray | 15 similar samples on MalwareBazaar |
| TLSH | 5224021687C433BAD678B737B55A8C3183B0B64885BDCF1FAB6C84819925347EA1762C |
| Reporter |  JAMESWT_WT |
| Tags: | Dridex |
Intelligence
File Origin
# of uploads :
9
# of downloads :
213
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
Clean
Maliciousness:
Behaviour
Sending a UDP request
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Dridex Dropper
Detection:
malicious
Classification:
bank.evad
Score:
88 / 100
Signature
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Dridex dropper found
Found potential dummy code loops (likely to delay analysis)
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
PE file contains section with special chars
Tries to detect virtualization through RDTSC time measurements
Behaviour
Behavior Graph:
Threat name:
Win32.Infostealer.Dridex
Status:
Malicious
First seen:
2020-11-24 06:19:34 UTC
File Type:
PE (Exe)
Extracted files:
13
AV detection:
25 of 29 (86.21%)
Threat level:
5/5
Verdict:
suspicious
Similar samples:
+ 5 additional samples on MalwareBazaar
Result
Malware family:
dridex
Score:
10/10
Tags:
family:dridex botnet loader
Behaviour
Dridex Loader
Dridex
Malware Config
C2 Extraction:
175.126.167.148:443
173.249.20.233:8043
162.241.204.233:4443
138.122.143.40:8043
173.249.20.233:8043
162.241.204.233:4443
138.122.143.40:8043
Unpacked files
SH256 hash:
bf1e36ac51a1a92eb6b5f4c68b67dfccc0692841d73045136cb9d7bc53bcf46d
MD5 hash:
b7304a0ce5f2732a115d1cc850eab13c
SHA1 hash:
8c6a82794b4c794fccce7a8c177551d4032945ff
SH256 hash:
2ed0010a999d077445bf90561755f90d5968e5814b42d80b1545cc15f6217bb5
MD5 hash:
09622943031f2affbf9bc67bad994786
SHA1 hash:
357f9db6ac8f007321d88f7064e3c7c5b328149f
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Dridex
Score:
1.00
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Web download
Delivery method
Distributed via web download
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.