🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c0aa43901407bffc679963fad11bbb658a87e4242fc49f0de17d37dff366dbf0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Dridex


Vendor detections: 8


Intelligence 8 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c0aa43901407bffc679963fad11bbb658a87e4242fc49f0de17d37dff366dbf0
SHA3-384 hash: be467ce1348ce8cc28de664e2bb49c3c685ee75143ae955b34156ed1b12599db88fd1c5263849be2359924b6248e6e71
SHA1 hash: b9683c1417937ee01431abb6198adb0a7cec25f2
MD5 hash: 00d1afce460239cbb320cb5fe4193e7f
humanhash: utah-kitten-purple-skylark
File name:00d1afce_by_Libranalysis
Download: download sample
Signature Dridex
Create hunting rule
File size:162'304 bytes
First seen:2021-05-20 17:20:04 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash f71b9cb9891e9cf4bae79d2b5aa115c6 (1'586 x Dridex)
ssdeep 3072:0iFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:3eAU/TeSH26cs+7
Threatray 18'399 similar samples on MalwareBazaar
TLSH 09F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352
Reporter Libranalysis
Tags:Dridex


Avatar
Libranalysis
Uploaded as part of the sample sharing project

Intelligence

File Origin
# of uploads :
1
# of downloads :
76
Origin country :
n/a
Vendor Threat Intelligence
Detection:
DridexLoader
Create hunting rule
Link:
https://www.capesandbox.com/analysis/160119/
Detection(s):
SecuriteInfo.com.Trojan.Agent.FFPX.110.28486.UNOFFICIAL
Create hunting rule

Win.Malware.Dridex-9853182-0
Create hunting rule

Win.Malware.Dridex-9853583-0
Create hunting rule

Win.Malware.Ffpx-9852716-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c0aa43901407bffc679963fad11bbb658a87e4242fc49f0de17d37dff366dbf0/
Threat name:
Win32.Trojan.Drixed
Create hunting rule
Status:
Malicious
First seen:
2021-05-20 17:20:17 UTC
AV detection:
41 of 47 (87.23%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ycveheaua677yz4zmp5ncg53mwfipzbef7cj6dpbpu35743g3pya._file
Verdict:
malicious
Label(s):
dridex
Create hunting rule
Similar samples:
0c81ee858583078cb79cd25edd743c485cfb5d21e3ca160c639e313349e0f79a
Dridex
0fd1a44694d87b991f3432664410b5ef69be316a94db693cd6db9ede9301dde6
Dridex
1903e3c932eb2b201e446ab4d501a749bb30a00df71141afe711086098b5425e
Dridex
2ede585bace78db6863a4175e1bcb15c490cd8f12f1549ca4d5819a19aaa81b4
Dridex
3bb3bfdd2cefb855797665b1b5e9e3bee5ec53e63978453720490d49392a3c46
Dridex
98da12297e69e7cd73e8dcdbce0b80904ddf8bb1b4d2626a5f3d9d51e0eb79b5
Dridex
adf593b8458c8d7a9a702833d8f66d98e03706896c3c747b0db6e0d21aa74a19
Dridex
bf882eb1c1a8fa686db3f972a3a8793c16531a394172efe0b4805320749b309d
Dridex
fdea2f27ab35cd9457b455a1c826d28319c7c779e324b029e227ae8c636bff9a
Dridex
ff62ab2db26fb1b8920873b86cbe55862234c4b60ebd80cbc38d302d7f7231d6
Dridex
+ 18'389 additional samples on MalwareBazaar
Result
Malware family:
dridex
Create hunting rule
Score:
  10/10
Tags:
family:dridex botnet:40111 botnet evasion loader trojan
Link:
https://tria.ge/reports/210520-s1qzgspfzs/
Behaviour
Suspicious use of WriteProcessMemory
Checks whether UAC is enabled
Dridex Loader
Dridex
Malware Config
C2 Extraction:
8.210.53.215:443
72.249.22.245:2303
188.40.137.206:8172
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Dridex
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/c0aa43901407bffc679963fad11bbb658a87e4242fc49f0de17d37dff366dbf0

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DridexLoader
Create hunting rule
Author:kevoreilly
Description:Dridex v4 dropper C2 parsing function
Rule name:DridexV4
Create hunting rule
Author:kevoreilly
Description:Dridex v4 Payload
Rule name:MALWARE_Win_DLLLoader
Create hunting rule
Author:ditekSHen
Description:Detects unknown DLL Loader
Rule name:win_dridex_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/160119/

Comments