MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d3cc0618a6f7030000a5e9ec177cb0309c2423b3ae19ef1053627f503deb2435. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Dridex


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d3cc0618a6f7030000a5e9ec177cb0309c2423b3ae19ef1053627f503deb2435
SHA3-384 hash: cc9c69bfff6617fd6fdf832e3d62dd1104c3c2c7c0f1391acac983bcb276069241887793cf12597ca3d8f6d378219280
SHA1 hash: 06412f445ac3bd70975924ffb4e8886700e7dc21
MD5 hash: 178bf4b9ada2e93b579e05a6123e78c7
humanhash: georgia-football-hydrogen-tango
File name:d3cc0618a6f7030000a5e9ec177cb0309c2423b3ae19ef1053627f503deb2435
Download: download sample
Signature Dridex
Create hunting rule
File size:871'424 bytes
First seen:2021-03-15 17:34:04 UTC
Last seen:2021-03-15 19:51:02 UTC
File type:DLL dll
MIME type:application/x-dosexec
imphash a87564b2db987732e7fd9963640bbed9 (10 x Dridex)
ssdeep 12288:+7WC6KqUEya1waZPw91SrGTN/v+CdMAVVQbRGMFGUgkr1g2hbTyobwppu:+iCJ1NWwamPv+OMIQ9WsJXX
Threatray 525 similar samples on MalwareBazaar
TLSH 4F05CE42B952C968C88584B6CE9CCDFE4A4DBF46CF782A4774C57F4F3334264A639628
Reporter Cryptolaemus1
Tags:10444 Dridex


Avatar
Cryptolaemus1
Dridex 10444

Intelligence

File Origin
# of uploads :
2
# of downloads :
154
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.Win32.Save.a.25568.9827.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Sending a UDP request
Sending a custom TCP request
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/dafa53a9-b85b-4ecb-82b7-d8dbe92a2d73
Result
Threat name:
Dridex
Create hunting rule
Detection:
malicious
Classification:
troj
Score:
60 / 100
Link:
https://www.joesandbox.com/analysis/639805
Signature
C2 URLs / IPs found in malware configuration
Found malware configuration
Yara detected Dridex unpacked file
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d3cc0618a6f7030000a5e9ec177cb0309c2423b3ae19ef1053627f503deb2435/
Threat name:
Win32.Packed.Generic
Create hunting rule
Status:
Suspicious
First seen:
2021-03-15 17:35:09 UTC
AV detection:
5 of 28 (17.86%)
Threat level:
  1/5
Verdict:
malicious
Label(s):
dridex
Create hunting rule
Similar samples:
3a4bd219435b2324b3976dbb7b90789aa4a5cb17567bc6a7129d1e73bfaaa413
Dridex
4474c2ccab521311c533fb7c3088da9be624fc16474c2765eec2f4941a2e8557
Dridex
4b2a101f9e7e0119409b6faae798c1e9fada080f055509f477c598365e1f6618
Dridex
82902f13b895c92b0995e65d4de03ff0cd50d89bbc027dc5e7ec338d9bede821
Dridex
83c390d82e19beec14d007b7350f4296c23ce9b3d131a3670ebb7424ad917410
Dridex
8b1203e7ff8ead64a388e8000955871b931202a9fd56ba339de65b01628fff6b
Dridex
9f38af84820dc29e805029409bbb2a5765036775973e3898b6db1f66c1b47270
Dridex
a97079f6fb077e6eef171b26442b94a2dceba1a5d386f9ce481c5810a7eab8f3
Dridex
b354b40413ec755a51a63ab930860d9078d9ad157f1f18b0d0c441d73bf6691c
Dridex
df2ed991a6ab65f2bc05805376dcf34de7febc5c5d4b37d400546e4e01d90fc0
Dridex
+ 515 additional samples on MalwareBazaar
Result
Malware family:
dridex
Create hunting rule
Score:
  10/10
Tags:
family:dridex botnet:10444 botnet discovery evasion loader trojan
Link:
https://tria.ge/reports/210315-1j74yyxmz6/
Behaviour
Suspicious use of WriteProcessMemory
Checks installed software on the system
Checks whether UAC is enabled
Blocklisted process makes network request
Dridex Loader
Dridex
Malware Config
C2 Extraction:
210.65.244.184:443
147.78.186.4:10051
62.75.168.152:6601
Unpacked files
SH256 hash:
34cc5917a4a47014cc130ba57df09770a8b4f9d5693b236a72ce38cf6089d938
MD5 hash:
4d9b0673197fabed8e5aaa9ea16af6fd
SHA1 hash:
13be5d9b204d681c4309db6bd3d95a37eb136077
Link:
https://www.unpac.me/results/7e931d47-905e-4131-894a-b9f55fd7d2a6/
SH256 hash:
d3cc0618a6f7030000a5e9ec177cb0309c2423b3ae19ef1053627f503deb2435
MD5 hash:
178bf4b9ada2e93b579e05a6123e78c7
SHA1 hash:
06412f445ac3bd70975924ffb4e8886700e7dc21
Link:
https://www.unpac.me/results/7e931d47-905e-4131-894a-b9f55fd7d2a6/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/d3cc0618a6f7030000a5e9ec177cb0309c2423b3ae19ef1053627f503deb2435

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Dridex

DLL dll d3cc0618a6f7030000a5e9ec177cb0309c2423b3ae19ef1053627f503deb2435

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1068686/
  
Delivery method
Distributed via web download

Comments