🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c0b724f92582625dc7bc44c89ce1fda666b52dbcec3c78228da762822fc58e49. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Dridex


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c0b724f92582625dc7bc44c89ce1fda666b52dbcec3c78228da762822fc58e49
SHA3-384 hash: f36d26230da9eb65c1fb1e8c2b5e0904b646022c7608e2878939cc191ecedc1cb70f990cff5ea3e11c17663204516bed
SHA1 hash: 92b3183abf073947c42d6f0e6cec92ee9d55ceca
MD5 hash: 78674892a4d2665fd9a2a0032ddf1124
humanhash: delta-speaker-six-uniform
File name:Zk8Iv9hirxx0i
Download: download sample
Signature Dridex
Create hunting rule
File size:204'800 bytes
First seen:2020-12-15 14:06:28 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash a23873606d43d18aeb728673d0ce4249 (15 x Dridex, 1 x Gozi)
ssdeep 3072:lFsIcCVMdHhbwlilXv+/dw7NN24M/1Z/NHPp6Yyb5RmShVo2D:lF32hXYd6rrM9BNCNYS
Threatray 42 similar samples on MalwareBazaar
TLSH 42149E41ABB60119F5FA073139FE79640AB57C094934FF5E3342B1ABAE39BD088947B1
Reporter JAMESWT_WT
Tags:Dridex

Intelligence

File Origin
# of uploads :
1
# of downloads :
233
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/108158/
Detection(s):
SecuriteInfo.com.Generic.mg.cdbc398cb79b82eb.5282.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Sending a UDP request
Result
Threat name:
Unknown
Detection:
clean
Classification:
n/a
Score:
2 / 100
Link:
https://www.joesandbox.com/analysis/563278
Behaviour
Behavior Graph:
n/a
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c0b724f92582625dc7bc44c89ce1fda666b52dbcec3c78228da762822fc58e49/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2020-12-15 14:07:10 UTC
File Type:
PE (Dll)
Extracted files:
29
AV detection:
12 of 46 (26.09%)
Threat level:
  5/5
Verdict:
unknown
Similar samples:
0c0a849067910325d3a8d5a6fc5ee0e24f418e6ea2e2ac0a91f93b6c81b25434
Dridex
0d271154fc1009f8f0034bbda517dc5f188a99100d6ef8a5827319b3ea30afff
Dridex
119c6a4fbc1df623f74334c646cdd3444916427eacdb3d9222be9f758017492d
Dridex
12b51b1bb3f57abdd5ddff5a2c86dd416d12669d85c1a999a419de5195e8f46d
Dridex
25ca541958b7124f79002d471a96d08c3b6cd4b28320ebf344f0330169d80d9a
Dridex
330e60400c9e8c9ce5261540d31fb346d4a874eddee5040e465a03b368facb41
Dridex
4d5f2df879408856825785fe3a63a6a119d7f617f4fc52243fc060d2708bf993
Dridex
5188398a523a59bb95068adcfd096082f5ef204dbc572ee09fa09e2da2bc9dd9
Dridex
9723745ac74305a2b053a8b775bcf6f286786f8125af27752198a785877a2389
Dridex
eb3154fc479e6ec838bffbf7cb1f4247c4286625e2311bf6ba50abf7a48044a1
Dridex
+ 32 additional samples on MalwareBazaar
Result
Malware family:
dridex
Create hunting rule
Score:
  10/10
Tags:
family:dridex botnet loader
Link:
https://tria.ge/reports/201215-ykx58h4ksj/
Behaviour
Suspicious use of WriteProcessMemory
Dridex Loader
Dridex
Malware Config
C2 Extraction:
77.220.64.37:443
85.25.144.36:4643
51.15.176.55:3389
139.162.53.147:4443
Unpacked files
SH256 hash:
c0b724f92582625dc7bc44c89ce1fda666b52dbcec3c78228da762822fc58e49
MD5 hash:
78674892a4d2665fd9a2a0032ddf1124
SHA1 hash:
92b3183abf073947c42d6f0e6cec92ee9d55ceca
Link:
https://www.unpac.me/results/b68ecb34-d1d7-46af-ab22-3fca223bfd40/
SH256 hash:
12e285edb308bda13a586e33b8f31162b345386c61ff86ba8e19cad8ba80a483
MD5 hash:
6955232e17cc1a2ca2f38585001a1c46
SHA1 hash:
57b74c0088144f7da9250724ef10ac993d9c2308
Link:
https://www.unpac.me/results/b68ecb34-d1d7-46af-ab22-3fca223bfd40/
SH256 hash:
786d3bac534c2ac628e64b7c691b63e1d216fa188e3a64afa1c0eb5c559db318
MD5 hash:
8f176b11a13202271b1a89240844441b
SHA1 hash:
0956bd680f64b343538760fd5a1a228d4ab8446f
Detections:
win_dridex_auto
Create hunting rule
Link:
https://www.unpac.me/results/b68ecb34-d1d7-46af-ab22-3fca223bfd40/
Parent samples :
4d5f2df879408856825785fe3a63a6a119d7f617f4fc52243fc060d2708bf993
eb3154fc479e6ec838bffbf7cb1f4247c4286625e2311bf6ba50abf7a48044a1
786d3bac534c2ac628e64b7c691b63e1d216fa188e3a64afa1c0eb5c559db318
0c0a849067910325d3a8d5a6fc5ee0e24f418e6ea2e2ac0a91f93b6c81b25434
12b51b1bb3f57abdd5ddff5a2c86dd416d12669d85c1a999a419de5195e8f46d
119c6a4fbc1df623f74334c646cdd3444916427eacdb3d9222be9f758017492d
c0b724f92582625dc7bc44c89ce1fda666b52dbcec3c78228da762822fc58e49
330e60400c9e8c9ce5261540d31fb346d4a874eddee5040e465a03b368facb41
5188398a523a59bb95068adcfd096082f5ef204dbc572ee09fa09e2da2bc9dd9
0d271154fc1009f8f0034bbda517dc5f188a99100d6ef8a5827319b3ea30afff
25ca541958b7124f79002d471a96d08c3b6cd4b28320ebf344f0330169d80d9a
9723745ac74305a2b053a8b775bcf6f286786f8125af27752198a785877a2389
4280c27f9e3a0dae47929420089498fbef465f2daf892e7ddb04e1395c87cee4
99d8c0a7a6f68abe97bea4001cb14850de35ea9b0b35e2c40956b2f30595f378
9591987a6dcacd5edeeb4374628c09f8674bec41fa5beb0969bf2eeb10f7707c
041edba5ccd1c771382c57e623f3393248fd4c6cd86822a99061a571a531d1b9
03a4a28ccf750c1be52da2e87c729a26fe48c72007e03aba045ffd2a617c3a8e
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.80
Link:
https://yomi.yoroi.company/submissions/c0b724f92582625dc7bc44c89ce1fda666b52dbcec3c78228da762822fc58e49

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/108158/

Comments