MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d77234374d79b24022c26ecdd16a684ae7e94efba502422d74852b0eddd4f1b4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Gozi


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d77234374d79b24022c26ecdd16a684ae7e94efba502422d74852b0eddd4f1b4
SHA3-384 hash: 7c5413813c967e406d0a71705675ac52ca91650713bc182234742a1c5dcf95d6c76bf571f743d5c691ab03bf18b708a2
SHA1 hash: 96a307cc2ba191e4872d1ef65697753cb13641a0
MD5 hash: bef6feb31ccd3364d883b306642cfaed
humanhash: hydrogen-ten-kitten-neptune
File name:96a307cc2ba191e4872d1ef65697753cb13641a0
Download: download sample
Signature Gozi
Create hunting rule
File size:647'168 bytes
First seen:2020-05-11 13:41:00 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash 87b16955b2aa167327f4d4229e828bd3 (2 x Gozi)
ssdeep 12288:68+VKUho/zExjnvSBvHtQC1H7aK5AEsAQvE86tSO2UxTXN2sigeeERhiXaiuYV1Q:68+VKMoqv4tQkJQvE8mSO2UxTXQsige8
Threatray 78 similar samples on MalwareBazaar
TLSH 75D44B10364DE238C9A902329C56F6FC01797E1DEF125E1B77EA3F4FF6B05418969A0A
Reporter JAMESWT_WT
Tags:Dridex Gozi

Intelligence

File Origin
# of uploads :
1
# of downloads :
89
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/3234/
Detection(s):
PUA.Win.Packer.PrivateExeProte-11
Create hunting rule

PUA.Win.Downloader.Aiis-6803892-0
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Dridex
Create hunting rule
Status:
Malicious
First seen:
2020-05-11 14:37:15 UTC
File Type:
PE (Dll)
AV detection:
22 of 31 (70.97%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
dridex
Create hunting rule
gozi
Create hunting rule
Similar samples:
0a383870010db689605e8aac2fd1a9ad284558ef9eccc6d07bdc9dbbc573480f
Gozi
19042ea0e61783a3c281e3f02e0e2e2b07e9421bae0afeeae21febe450510f0c
Gozi
4655c0216538f752dea2ce1649807d597cd83a935f1385bdd8f418616de97b68
Gozi
5ade0c4492ffe4b77776543635a5cad0eef6d4a207f69dac0a59f9ad76aa42ba
Gozi
75d79cd50c0f3def32be69db58e716d7094006636c8ff9479254ff34224d327e
Gozi
ab44ef41e492f3df1be566ddde081d666b3e9f55ee6f0f195fe0acd4d9701912
Gozi
d3e9f6933d519b6bd1514ceaaa14df64722214c0c6c2a60a6924c92f284b3c08
Gozi
e9880c5c608141c8ec12ce1a8d14652731583e4055f74ce2727afe8c3ea15cb6
Gozi
f32072d7d581e1a8d04c47b21dafadd58e3dccc3aa0188d7f95f6867944475e0
Gozi
fcd9abcb235ec7aea9a425394952653a57b44ba9233e934289d2b6892fac82b2
Gozi
+ 68 additional samples on MalwareBazaar
Result
Malware family:
dridex
Create hunting rule
Score:
  10/10
Tags:
family:dridex botnet discovery evasion loader trojan
Link:
https://tria.ge/reports/201109-qblhkr8l2n/
Behaviour
Suspicious use of WriteProcessMemory
Checks installed software on the system
Checks whether UAC is enabled
Blacklisted process makes network request
Dridex Loader
Dridex
Malware Config
C2 Extraction:
178.128.83.136:443
138.122.143.41:8443
85.25.106.204:691
159.203.136.67:3308
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/3234/
Cape
Cape
https://www.capesandbox.com/analysis/3233/

Comments