MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 f0ecc44eacafdb97e9a84785bbdcffce312393c0e219d27040b42a3d4c93f45e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Dridex
Vendor detections: 7
| SHA256 hash: | f0ecc44eacafdb97e9a84785bbdcffce312393c0e219d27040b42a3d4c93f45e |
|---|---|
| SHA3-384 hash: | 6afbc3f42fd62e4133383e2676e5fe79686dc2ec75a645430d7360594048c325993e22ab0abf11db2bff30283fd3f513 |
| SHA1 hash: | 4a57b09d98986c21bcd5d3ce6d770247badfe37d |
| MD5 hash: | 6c1ea137c6275b4de45be3a7943831f2 |
| humanhash: | tango-stream-blue-music |
| File name: | 6c1ea137c6275b4de45be3a7943831f2.dll |
| Download: | download sample |
| Signature | Dridex |
| File size: | 163'840 bytes |
| First seen: | 2020-12-08 16:12:59 UTC |
| Last seen: | Never |
| File type: |  dll |
| MIME type: | application/x-dosexec |
| imphash | 842840b4a5fa1ec7b68830dd7f3c6f0f (3 x Dridex) |
| ssdeep | 3072:pyJBV7TXFiHn6LhN4UMELprgwwYdmpyPWNwOIU/x34dECL5Ff:pMBVvXdf9gww+mgK/jxbO |
| Threatray | 13 similar samples on MalwareBazaar |
| TLSH | C9F3D082E3CDA7ADF98222B7B355D23B59E2BD08C02BE43CF64A3ADB5535120F454E45 |
| Reporter |  abuse_ch |
| Tags: | dll Dridex |
Intelligence
File Origin
# of uploads :
1
# of downloads :
189
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Result
Verdict:
Clean
Maliciousness:
Behaviour
Sending a UDP request
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Unknown
Detection:
suspicious
Classification:
n/a
Score:
22 / 100
Signature
Machine Learning detection for sample
Behaviour
Behavior Graph:
Threat name:
Win32.Infostealer.Dridex
Status:
Malicious
First seen:
2020-12-08 16:13:05 UTC
AV detection:
17 of 29 (58.62%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
unknown
Similar samples:
+ 3 additional samples on MalwareBazaar
Result
Malware family:
dridex
Score:
10/10
Tags:
family:dridex botnet loader
Behaviour
Suspicious use of WriteProcessMemory
Dridex Loader
Dridex
Malware Config
C2 Extraction:
169.255.216.36:443
87.106.89.36:3389
27.254.174.84:4443
92.94.251.127:3786
87.106.89.36:3389
27.254.174.84:4443
92.94.251.127:3786
Unpacked files
SH256 hash:
f0ecc44eacafdb97e9a84785bbdcffce312393c0e219d27040b42a3d4c93f45e
MD5 hash:
6c1ea137c6275b4de45be3a7943831f2
SHA1 hash:
4a57b09d98986c21bcd5d3ce6d770247badfe37d
SH256 hash:
58f51f839f05667d79a641c87bb04b5460e4579e2a946dbd9f36d35868b237fa
MD5 hash:
d91a642dc940321c5f0fa1c74d4b1972
SHA1 hash:
5fb68e615ad9a3c1a81dc54a5edb3a560a8e1f81
SH256 hash:
43762ec66d49d22047f6e1f8aa990105ddec0d84d73934977ba0d439094f8e3b
MD5 hash:
d2c12689b161957236f416615a8aa85d
SHA1 hash:
2577ac72b1bbc52294a5a47f11fc9d4cb21111ee
Detections:
win_dridex_auto
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.24
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Web download
Delivery method
Distributed via web download
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.