MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d6ddd24040b1f1ae7f42c84ee15f52efa36054e7ed4bb47d177d6b5108c9e5f6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Dridex


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d6ddd24040b1f1ae7f42c84ee15f52efa36054e7ed4bb47d177d6b5108c9e5f6
SHA3-384 hash: 61300787362678893753fb984d6f01cdb55e0042b97b14650c0cad11125633b1fc2bc150ec38ce665bb265252dbb49ed
SHA1 hash: 0c8f8ec1f08bc7bb324293a1278556a379fd6b75
MD5 hash: d39acb349cd89c22d3ddf69b5cda0f98
humanhash: earth-red-carbon-mango
File name:mkcxskjd.exe
Download: download sample
Signature Dridex
Create hunting rule
File size:200'704 bytes
First seen:2020-06-23 13:15:24 UTC
Last seen:2020-06-23 13:50:44 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 5f5d7f3d576b5fd54d7374e64458a706 (3 x Dridex)
ssdeep 6144:RQYmU2JFD8euKJ7lfJy7ZcYrDZM8DY8gGTlj:RMU2z8NKJRsrDZM8D5
Threatray 262 similar samples on MalwareBazaar
TLSH 61140119778481B7F79295307D67F5B90A952C734814C66F1F82391CEEBEA2688F032B
Reporter abuse_ch
Tags:Dridex exe


Avatar
abuse_ch
Malspam distributing Dridex:

HELO: ereceivedstoptopvip.xyz
Sending IP: 194.150.214.187
From: Elga Calley <fix@ereceivedstoptopvip.xyz>
Reply-To: nadin.kara@dreammind.com
Subject: Past Due Invoice No. #527023
Attachment: 275247.xlsm

Dridex payload URL:
http://mekund.com/mkcxskjd.exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
102
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/12983/
Detection(s):
SecuriteInfo.com.Gen.NN.ZexaF.34128.mu0@aueVSNei.21194.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d6ddd24040b1f1ae7f42c84ee15f52efa36054e7ed4bb47d177d6b5108c9e5f6/
Threat name:
Win32.Infostealer.Dridex
Create hunting rule
Status:
Malicious
First seen:
2020-06-23 13:17:04 UTC
File Type:
PE (Exe)
Extracted files:
2
AV detection:
25 of 31 (80.65%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=23o5eqcawhy2472czbhocx2s56rwavhh5vf3i7ixpvvvccgj4x3a._file
Verdict:
malicious
Similar samples:
8693d6aaa3f5cb0e2c6e725eaa9d6abf1bcf8f8390625767312b5af32e204118
Dridex
a6aba7b7f6eeeb871e7c58959307a260e3f20b54b7d4a174c9bc03ce4eb94a94
Dridex
af1ab453137d6610127a5a3e310c3756d10977a71d231f9e37a9763b1254fdc1
Dridex
b291ecc1c7cbd5549a0b9f400fe015af47fb6be96ec277e66c3795b9ff4dc95c
Dridex
b4f32ff1f6a1a6db2497781d64c19868972dbc35be7ff881b63771c96a87a054
Dridex
b65a639e435aa80ece4326d85052f980a9992788d4b9b7fb94141d7e82ddc960
Dridex
c04c4bb521cb18dc16fbacc4220c0f854bfadfdc0c016ec6fd868d52fe8c3e08
Dridex
dbbaf0499e544e3832699110f71f62a521ec93cc8a74656c92af7023f554d897
Dridex
ec5c427c6ebf8bd614eea2346509bad3b37f0a090bd2217a1a11835dd9df2562
Dridex
eecae1c4f0341afd1a089da83da76e7a1e31f3f2243269722c9d0c9457c2ef85
Dridex
+ 252 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/200624-5ec6f8hpz6/
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Dridex

Excel file xlsm cb58b0d9a9f1e7e950ec144b1feef24aa178a9535ebb2e6dbda99fef2c8d90dc

Dridex

Executable exe d6ddd24040b1f1ae7f42c84ee15f52efa36054e7ed4bb47d177d6b5108c9e5f6

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/400703/
  
Dropped by
SHA256 cb58b0d9a9f1e7e950ec144b1feef24aa178a9535ebb2e6dbda99fef2c8d90dc
  
Dropped by
MD5 15e1f70191df1e6b8ae897fcd7339129
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/12983/

Comments