MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 eb1a0c3677f4b416e43e2c4d88a30d1f5bd4d9b00b1e0c48efef31b034465e3c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Dridex


Vendor detections: 8


Intelligence 8 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: eb1a0c3677f4b416e43e2c4d88a30d1f5bd4d9b00b1e0c48efef31b034465e3c
SHA3-384 hash: 6e438941648322d8ba4aace758e0778a1aa90dda672af51995aa7d8b3c99b7bf13ba32d1efa85ba480669b25e75a12f0
SHA1 hash: 06faf7fce11b89e4119c70c5a8cb56d97ab68bab
MD5 hash: ba7ddbd663a50b149b22d810f4211207
humanhash: vegan-mango-quiet-monkey
File name:qz0h69pdf
Download: download sample
Signature Dridex
Create hunting rule
File size:552'448 bytes
First seen:2020-11-19 13:03:46 UTC
Last seen:2020-11-19 15:13:21 UTC
File type:DLL dll
MIME type:application/x-dosexec
imphash 18cb5c18face4302b794af9a2931a4bc (7 x Dridex, 1 x Gozi)
ssdeep 6144:RkF19P2yLnafTR93YBgobwN+5AxtyTCjzVm8NsCuC:RkFne883YdbY+5QyTE1k
Threatray 153 similar samples on MalwareBazaar
TLSH 25C46102FCA74F5BD623127B24C660406D0ADC8C5F48E487A3A7F57492B73F46DE926A
Reporter JAMESWT_WT
Tags:dll Dridex

Intelligence

File Origin
# of uploads :
4
# of downloads :
150
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Mal.EncPk-APV.1189.1806.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Unknown
Detection:
malicious
Classification:
n/a
Score:
52 / 100
Link:
https://www.joesandbox.com/analysis/542909
Signature
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/eb1a0c3677f4b416e43e2c4d88a30d1f5bd4d9b00b1e0c48efef31b034465e3c/
Threat name:
Win32.Trojan.Ursnif
Create hunting rule
Status:
Malicious
First seen:
2020-11-19 13:04:06 UTC
File Type:
PE (Dll)
Extracted files:
5
AV detection:
25 of 29 (86.21%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=5mnayntx6s2bnzb6frgyriynd5n5jwnqbmpayshp54y3ancgly6a._file
Verdict:
malicious
Label(s):
dridex
Create hunting rule
Similar samples:
0dfab637891eaf6ff9134a21c5200d677f6e915a25b43e8a4acc5fe90f793033
Dridex
3a051adde831c2fd025774dfa237db5b442bc654eceacf99b3b6aec7092a29da
Dridex
4bbf766e8ac0148b77e659e3a3cfd110c6f219468c240987874c03107b4f8826
Dridex
6d5ca5fcaba6a6558013344ff5f11328e8079540e8ebe95789d9c185e11f8e44
Dridex
77419f5d237715b7664ae53e806dea7465cdb6159f76a462fc31fcd731db5f2b
Dridex
881c022032c6fb9bedfae76dd6c93863b2b7f48e282e0dbcbdcf702a6958ced2
Dridex
8cc5a65a8206e82d93604182bb6cd7f72e08a6b45cdf07e6479e493457c0ab12
Dridex
92513d7788e6c70e269721a5454411ca78b13513ab597e3e16b9f9fad2bf0807
Dridex
ae9628344dfef9e22d8bb19fd5001329640ec5573c5503e3ae99788ef7b58f1c
Dridex
af3c57b18d35f88f076c5b15fd7cc814d4e7724037158d7e5a3facf9bece3d26
Dridex
+ 143 additional samples on MalwareBazaar
Result
Malware family:
dridex
Create hunting rule
Score:
  10/10
Tags:
family:dridex botnet discovery evasion loader trojan
Link:
https://tria.ge/reports/201119-j7xwl67bmn/
Behaviour
Suspicious use of WriteProcessMemory
Checks installed software on the system
Checks whether UAC is enabled
Blacklisted process makes network request
Dridex Loader
Dridex
Malware Config
C2 Extraction:
162.241.44.26:9443
192.232.229.53:4443
77.220.64.34:443
193.90.12.121:3098
Unpacked files
SH256 hash:
11e755c9d1a5ea74dfc765a2f44eb7c3bbc2d735fcf2489882ede6aeb0816493
MD5 hash:
180230a6ffbbf57a370da06c41b26cf1
SHA1 hash:
2f25b00b16544615b766e5efd10555797177f29a
Link:
https://www.unpac.me/results/911e481a-5ed6-49ae-9e64-c82b7aad7417/
SH256 hash:
eb1a0c3677f4b416e43e2c4d88a30d1f5bd4d9b00b1e0c48efef31b034465e3c
MD5 hash:
ba7ddbd663a50b149b22d810f4211207
SHA1 hash:
06faf7fce11b89e4119c70c5a8cb56d97ab68bab
Link:
https://www.unpac.me/results/911e481a-5ed6-49ae-9e64-c82b7aad7417/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/eb1a0c3677f4b416e43e2c4d88a30d1f5bd4d9b00b1e0c48efef31b034465e3c

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Dridex

DLL dll eb1a0c3677f4b416e43e2c4d88a30d1f5bd4d9b00b1e0c48efef31b034465e3c

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/832925/
  
Delivery method
Distributed via web download

Comments