MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ce1dd4671c2f31856e6f8c275ca00c0ed3219a981c749d9e278aa7de550e7a4f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Dridex


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ce1dd4671c2f31856e6f8c275ca00c0ed3219a981c749d9e278aa7de550e7a4f
SHA3-384 hash: c08519e0f1e0aa32cea19700b1045d4fd9514842b69e5a655343b0b911388780f70746e38596f94ce6919e6abe83bd99
SHA1 hash: ffe49c6d7074c28f70fae9dc0dc9fd522d0dcfee
MD5 hash: 95fe1cb7dcc4a524bd16ae51ee10de46
humanhash: uniform-glucose-nine-robert
File name:95fe1cb7dcc4a524bd16ae51ee10de46.dll
Download: download sample
Signature Dridex
Create hunting rule
File size:70'669 bytes
First seen:2020-10-16 18:56:43 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
ssdeep 1536:LrS3ixBjj5UQaW75WAY6TtnfLGuw0lrBaLmg8qpYnTv5dpGIPIYGxoNg:nS3ixdj5Ut+cd6T9f40BNlTv5dpGIgR7
TLSH FE63AE03DAEAE5F5C59A90B9C43BD125277358E7170578E20BF06B1DDF22A926630F42
Reporter abuse_ch
Tags:dll Dridex

Intelligence

File Origin
# of uploads :
1
# of downloads :
153
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/72252/
Detection(s):
SecuriteInfo.com.Trojan.Dridex.735.11434.31330.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
Result
Threat name:
Unknown
Detection:
suspicious
Classification:
n/a
Score:
23 / 100
Link:
https://www.joesandbox.com/analysis/494137
Signature
a
c
d
e
f
g
h
i
L
M
n
o
p
r
s
t
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ce1dd4671c2f31856e6f8c275ca00c0ed3219a981c749d9e278aa7de550e7a4f/
Threat name:
Win32.Trojan.Ymacco
Create hunting rule
Status:
Malicious
First seen:
2020-10-16 18:58:06 UTC
AV detection:
29 of 48 (60.42%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=zyo5izy4f4yyk3tprqtvziamb3jsdguydr2j3hrhrkt54viopjhq._file
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/201016-7bdk9tze8n/
Behaviour
Suspicious use of WriteProcessMemory
Unpacked files
SH256 hash:
ce1dd4671c2f31856e6f8c275ca00c0ed3219a981c749d9e278aa7de550e7a4f
MD5 hash:
95fe1cb7dcc4a524bd16ae51ee10de46
SHA1 hash:
ffe49c6d7074c28f70fae9dc0dc9fd522d0dcfee
Link:
https://www.unpac.me/results/33adb28c-f9dd-4a1d-9394-d01f53a900dd/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Dridex
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/ce1dd4671c2f31856e6f8c275ca00c0ed3219a981c749d9e278aa7de550e7a4f

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Dridex

DLL dll ce1dd4671c2f31856e6f8c275ca00c0ed3219a981c749d9e278aa7de550e7a4f

(this sample)

Cape
Cape
https://www.capesandbox.com/analysis/72252/
  
URLhaus
https://urlhaus.abuse.ch/url/658191/
  
Delivery method
Distributed via web download

Comments