MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cd4ccf6b266b11aa29327444754c4c42f175725c4c03e21cf5dae151a4c4aa41. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Dridex


Vendor detections: 7


Intelligence 7 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: cd4ccf6b266b11aa29327444754c4c42f175725c4c03e21cf5dae151a4c4aa41
SHA3-384 hash: 9194c30b60c7dec9b58ae7a45ab859c352a6a3c30bc9741ea352c782c86ffc71ed4824f42835483537baa70a9c3d9b8c
SHA1 hash: 73c05bd6ee0d49a8202d4ec4b4a90e27a1aa3174
MD5 hash: 8c115bfae5facea4fd720b5bbe39136d
humanhash: stairway-burger-bulldog-berlin
File name:DRIDEX (4)
Download: download sample
Signature Dridex
Create hunting rule
File size:327'680 bytes
First seen:2020-09-24 07:37:23 UTC
Last seen:2020-09-24 08:37:06 UTC
File type:DLL dll
MIME type:application/x-dosexec
imphash 0711eaedc93119f4fba09fc656e118ab (7 x Dridex)
ssdeep 3072:j4LaiXGwW6f3ny73vo0FbxbqOwO42GLSGL5UUoIPjgbgba5ytyiqNTPmSvld2hJk:jBrwXy7wvxSGGJIPje15Nvld3s5pd
Threatray 34 similar samples on MalwareBazaar
TLSH 4D64E1113AE65929F6B36B708DBB05048F1F7E912C3C81CE86111B5A9A63640CFE7FB5
Reporter JAMESWT_WT
Tags:Dridex

Intelligence

File Origin
# of uploads :
2
# of downloads :
163
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Detection(s):
SecuriteInfo.com.Trojan.Dridex.735.32767.25479.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
Result
Threat name:
Unknown
Detection:
malicious
Classification:
n/a
Score:
52 / 100
Link:
https://www.joesandbox.com/analysis/474068
Signature
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 289480 Sample: DRIDEX (4) Startdate: 24/09/2020 Architecture: WINDOWS Score: 52 10 Multi AV Scanner detection for submitted file 2->10 12 Machine Learning detection for sample 2->12 6 loaddll32.exe 1 2->6         started        process3 process4 8 WerFault.exe 3 9 6->8         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/cd4ccf6b266b11aa29327444754c4c42f175725c4c03e21cf5dae151a4c4aa41/
Threat name:
Win32.Infostealer.Dridex
Create hunting rule
Status:
Malicious
First seen:
2020-09-24 02:15:00 UTC
File Type:
PE (Dll)
AV detection:
23 of 29 (79.31%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
dridex
Create hunting rule
Similar samples:
147ebcc44853cc5a776a50bb099177d4d87e00960aec208d2283f0b0c8c08b99
Dridex
1f8dc085e250847f7a31d7785710be49b17eed1e1c6e460478e2e5232bda689a
Dridex
2c57cdeb1938688244dcaf05544e47daef28a6cec2866a674df9b6a4ed45237a
Dridex
3ab48ca45cd8a40aa0100279752afd3e89003bb85bf420c8b1be62e019f4c9eb
Dridex
8ae193225bd1a7192315a7003aa4aa9565c573b6078f48cc9e290c9b0798235e
Dridex
92794ce2b86f5636b0636952f7ac4b02f0fd664b5f479372d64aa779d376a7a2
Dridex
b6061934972e541bf1f421f92c7342892661ebb98f75bd833b4c14ddbdd9291f
Dridex
d9405516d908f39043c9971884df73b57ae6db3002364444ec9b4e2a1d026ddb
Dridex
dd39accfa55be48b2c14f264a5917ead4964b8a7ce7f3f113cc74d13f87e86e7
Dridex
fd4159627ae84c3010c4fa3398c64d9639997d795338ab11fe2ad464f160b74e
Dridex
+ 24 additional samples on MalwareBazaar
Result
Malware family:
dridex
Create hunting rule
Score:
  10/10
Tags:
botnet loader family:dridex
Link:
https://tria.ge/reports/200924-wlea7y1aq6/
Behaviour
Suspicious use of WriteProcessMemory
Dridex Loader
Dridex
Malware Config
C2 Extraction:
151.236.219.181:443
142.4.6.57:14043
162.144.127.197:3786
103.40.116.68:5443
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Alureon
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/cd4ccf6b266b11aa29327444754c4c42f175725c4c03e21cf5dae151a4c4aa41

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Dridex

DLL dll cd4ccf6b266b11aa29327444754c4c42f175725c4c03e21cf5dae151a4c4aa41

(this sample)

Cape
Cape
https://www.capesandbox.com/analysis/65266/
  
URLhaus
https://urlhaus.abuse.ch/url/609431/
  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/609437/
  
URLhaus
https://urlhaus.abuse.ch/url/609446/
  
URLhaus
https://urlhaus.abuse.ch/url/609448/
  
URLhaus
https://urlhaus.abuse.ch/url/609475/

Comments