MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f072b971950ba8a2e12c85501f0d63160f833df8411c5fa1cda8ac6261b27a2d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Dridex


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f072b971950ba8a2e12c85501f0d63160f833df8411c5fa1cda8ac6261b27a2d
SHA3-384 hash: 89281f6c518b1fb193a95d84c9312a3aed8be684b1224f16bd1e914a6afc4127d7f7da6ff51751bba3a3e39a7403ad96
SHA1 hash: 365994b4255c68753b8972cc953c348926bb3207
MD5 hash: aeaacc4da7ea15de0224d4c3e3456ce0
humanhash: thirteen-magazine-vegan-dakota
File name:clax.exe
Download: download sample
Signature Dridex
Create hunting rule
File size:245'760 bytes
First seen:2020-05-11 15:46:29 UTC
Last seen:2020-05-11 17:09:13 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 838d09ab32f92a82bd3ee8cfed69ffe0 (2 x Dridex)
ssdeep 6144:RQTpcTG6P4QPrApDAeDrzTLnUEudn2G7I99:RQ8HgQD2AeXoFnB72
Threatray 100 similar samples on MalwareBazaar
TLSH 3334BE62A7F9A605F5F36F716C7A16844E3ABD929C39C60D2340254D4DB6F80DE60B33
Reporter abuse_ch
Tags:Dridex exe


Avatar
abuse_ch
Dridex payload URL:
http://geundik.com/clax.exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
114
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Generic.mg.aeaacc4da7ea15de.10007.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Dridex
Create hunting rule
Status:
Malicious
First seen:
2020-05-12 02:46:28 UTC
AV detection:
25 of 31 (80.65%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=6bzls4mvboukfyjmqvib6dldcyhygppyieof7ionvcwgeynspiwq._file
Verdict:
malicious
Label(s):
dridex
Create hunting rule
Similar samples:
043da6ea28e1ae44078f4941c3e7db3c63566f4b312121bd3f81b6b3cec0e8d7
Dridex
055f7e7b22e851afae09773a609a4f354e2dd8455b2eaf2301eb3d8701b60936
Dridex
110fe6f199298f89f704050eb4dc0d2b19b0985a74ead588441fabac693ab3f5
Dridex
4160e31c01e1c9fbad1e737efb974a0cb35721023607e831292c26873bdee4db
Dridex
4fae283ae2323e49f1a95871e773e3a2bfe54dc151cd7c11cbe41a36fd83bb14
Dridex
55897dc537d308842906dbf8bffde6eb846cdd6b5e9584d7efcbe7c342d5e699
Dridex
6d0c9ea95d779737b7e9ea2a838a0efede90f1d3c6ce91943e65067a82631b81
Dridex
a84a6fde4dbc4575700b8be705ed1df6d576e5aa6054aa66f1fae98350484a84
Dridex
c4f35b00490a1875286701b5909053c04668e4ec09da8e4ecd7405a3c136d6b0
Dridex
c6a810bf84ea3fd17a282d2a10bec7811c79ff751d5dbcf9eb84cff95f1fd5ba
Dridex
+ 90 additional samples on MalwareBazaar
Result
Malware family:
dridex
Create hunting rule
Score:
  10/10
Tags:
family:dridex botnet loader
Link:
https://tria.ge/reports/201109-451gy6355a/
Behaviour
Dridex Loader
Dridex
Malware Config
C2 Extraction:
178.128.83.136:443
138.122.143.41:8443
85.25.106.204:691
159.203.136.67:3308
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Dridex

Excel file xlsm f05fc81f6ca40aa7f1e50d4c7c217a71862e562602005fd66af89b86b3128d52

Dridex

Executable exe f072b971950ba8a2e12c85501f0d63160f833df8411c5fa1cda8ac6261b27a2d

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/361218/
  
Dropped by
MD5 7b1ed50fa4b33361fd6135efd8f5600a
  
Dropped by
SHA256 f05fc81f6ca40aa7f1e50d4c7c217a71862e562602005fd66af89b86b3128d52
  
Delivery method
Distributed via e-mail link

Comments