MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e4b64ec60414d405447d6299b98e2729cc407b0671932470870851bd1b6fa832. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry



Dridex


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments 1

SHA256 hash: e4b64ec60414d405447d6299b98e2729cc407b0671932470870851bd1b6fa832
SHA3-384 hash: 1365f3510c7117a87030f74b78885565c268e04c156c1029aa063e71913488089ca99e85a27a22adf9e2c9fa196c33a9
SHA1 hash: 8953c22b608d7f17e5f383fc87aa0a4d255cb5ca
MD5 hash: f3d3e09c39a491f42c4e04d85196c165
humanhash: bulldog-xray-five-mississippi
File name:f3d3e09c_by_Libranalysis
Download: download sample
Signature Dridex
File size:165'888 bytes
First seen:2021-05-07 18:01:52 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash 987b9d7dc84d935c3675da82d40e06f2 (8'604 x Dridex, 2 x Gozi, 1 x Tofsee)
ssdeep 3072:fIcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:Ac7UtOpM1Z5k1xYO2LXjTH1pH5nF1p
Threatray 8'301 similar samples on MalwareBazaar
TLSH 19F3C088CBB3E4E6EFB2D37976F85E1B461674551408B4F4C86CA58F74ABD008AE50F1
Reporter Libranalysis
Tags:Dridex


Avatar
Libranalysis
Uploaded as part of the sample sharing project

Intelligence


File Origin
# of uploads :
1
# of downloads :
102
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
56 / 100
Signature
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Tries to detect sandboxes / dynamic malware analysis system (file name check)
Behaviour
Behavior Graph:
behaviorgraph top1 signatures2 2 Behavior Graph ID: 407713 Sample: f3d3e09c_by_Libranalysis Startdate: 08/05/2021 Architecture: WINDOWS Score: 56 17 Multi AV Scanner detection for submitted file 2->17 19 Machine Learning detection for sample 2->19 8 loaddll32.exe 1 2->8         started        process3 process4 10 cmd.exe 1 8->10         started        process5 12 rundll32.exe 10->12         started        signatures6 21 Tries to detect sandboxes / dynamic malware analysis system (file name check) 12->21 15 WerFault.exe 23 9 12->15         started        process7
Threat name:
Win32.Trojan.Drixed
Status:
Malicious
First seen:
2021-05-07 18:02:20 UTC
AV detection:
27 of 29 (93.10%)
Threat level:
  5/5
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Unpacked files
SH256 hash:
e4b64ec60414d405447d6299b98e2729cc407b0671932470870851bd1b6fa832
MD5 hash:
f3d3e09c39a491f42c4e04d85196c165
SHA1 hash:
8953c22b608d7f17e5f383fc87aa0a4d255cb5ca
Please note that we are no longer able to provide a coverage score for Virus Total.

File information


The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Dridex

DLL dll e4b64ec60414d405447d6299b98e2729cc407b0671932470870851bd1b6fa832

(this sample)

  
Delivery method
Distributed via web download

Comments



Avatar
a̵c̵c̸i̵d̷e̵n̷t̴a̷l̴r̵e̷b̸e̴l̸ commented on 2021-05-07 19:08:47 UTC

============================================================
MBC behaviors list (github.com/accidentalrebel/mbcscan):
============================================================
0) [B0009] Anti-Behavioral Analysis::Virtual Machine Detection
1) [C0026.002] Data Micro-objective::XOR::Encode Data