MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f72bbba2814630af977b32b71152e7b499a9d154ad2aba5f4b8837081af9ac80. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Dridex


Vendor detections: 7


Intelligence 7 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f72bbba2814630af977b32b71152e7b499a9d154ad2aba5f4b8837081af9ac80
SHA3-384 hash: f866608e99dc9b57283cde5f20dbcb00b9cf13975dc614305b3a10a98236a0afc87f9e1bd0cfede264b49a26c1a69848
SHA1 hash: 3528c55c3bb19b279de9c4ee847953d50b8918ff
MD5 hash: 2eb6f6ca25507f8f9fce5b724d80800d
humanhash: nitrogen-lima-sweet-diet
File name:gmt6s0o.zip.dll
Download: download sample
Signature Dridex
Create hunting rule
File size:564'568 bytes
First seen:2020-11-12 15:56:52 UTC
Last seen:2024-07-24 23:09:44 UTC
File type:DLL dll
MIME type:application/x-dosexec
imphash 108c03d319577150f623cda6e1e3914f (4 x Dridex)
ssdeep 6144:vt7IsSogD0/l5qex6JOVVJBo2zT1LAxGDaQ3gnNB4/FQ9:171T6q6sbJm4LAxggNK/y9
Threatray 90 similar samples on MalwareBazaar
TLSH 09C4E490BDA91261E0AD0E32764778BB05DB3443FB73612626D77FE4E5A01B43DBA321
Reporter James_inthe_box
Tags:dll Dridex

Code Signing Certificate

Organisation:AXZUWFJYMRWEBPPSZH
Issuer:AXZUWFJYMRWEBPPSZH
Algorithm:sha1WithRSA
Valid from:Nov 12 12:54:31 2020 GMT
Valid to:Dec 31 23:59:59 2039 GMT
Serial number: 2A8FD9D5CD46EE9349F5BD5B1D249DFB
Thumbprint Algorithm:SHA256
Thumbprint: F7265FDD32F85448B83E4A7C23D15D462954203D152892CA2A069B1A53622C68
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin
# of uploads :
3
# of downloads :
87
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Mal.EncPk-APV.3627.20487.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Unknown
Detection:
malicious
Classification:
n/a
Score:
52 / 100
Link:
https://www.joesandbox.com/analysis/532998
Signature
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f72bbba2814630af977b32b71152e7b499a9d154ad2aba5f4b8837081af9ac80/
Threat name:
Win32.Infostealer.Dridex
Create hunting rule
Status:
Malicious
First seen:
2020-11-12 15:56:06 UTC
File Type:
PE (Dll)
Extracted files:
11
AV detection:
24 of 29 (82.76%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=64v3xiubiyyk7f33gk3rcuxhwsm2tukuvuvlux2lra3qqgxzvsaa._file
Verdict:
malicious
Label(s):
dridex
Create hunting rule
Similar samples:
51acefd32d0606f3059320b05197fe99f121a22dec166964ae6f447854f5c82c
Dridex
59b1087ec423c56cba3ca5ef050b8f86a9fb22ddddcf096ca6d92363efaabe2f
Dridex
61ec25c0d71e16e8208d3b2ccb2c7f7b9f5580c992e538d256393d8085919560
Dridex
6b34671b04872cfde098c319f20693021a43ddb8b00f989669778e745e5232a4
Dridex
857b5c1209e2bec7dda0c80b92123f4ceb15f8c560f23551804e4bd09b94e901
Dridex
905960957f03c7a56deaee448ac8fff59f7aad97619ee5a98eb220b9cebee849
Dridex
a50ac006054905d1f7fb342ba9053b5cecd381b67c54c9cab365f9b4eca2ee1b
Dridex
adf6d91922505e07b840cdd9f74d33d6c7872bc6534a9be6b27b5d03470c835b
Dridex
d7093640c50ebce8ea387148099bb0e30c9387d2748f728f10398dfd4e365450
Dridex
ef93251e31ce7ce387898be4ce0d7acf735f8e21ae9e6f453d6e2cd594e96bcb
Dridex
+ 80 additional samples on MalwareBazaar
Result
Malware family:
dridex
Create hunting rule
Score:
  10/10
Tags:
family:dridex botnet discovery evasion loader trojan
Link:
https://tria.ge/reports/201112-n931dy4mds/
Behaviour
Suspicious use of WriteProcessMemory
Checks installed software on the system
Checks whether UAC is enabled
Blacklisted process makes network request
Dridex Loader
Dridex
Malware Config
C2 Extraction:
77.220.64.39:443
69.164.207.140:3388
78.47.139.43:4443
103.244.206.74:33443
Unpacked files
SH256 hash:
f72bbba2814630af977b32b71152e7b499a9d154ad2aba5f4b8837081af9ac80
MD5 hash:
2eb6f6ca25507f8f9fce5b724d80800d
SHA1 hash:
3528c55c3bb19b279de9c4ee847953d50b8918ff
Link:
https://www.unpac.me/results/22f3df88-9da5-481e-b73d-5351e8be006e/
SH256 hash:
783207fde5bd2deb9f23433f73a6f85b0621eef3a9a40a645fd64a6074809c42
MD5 hash:
060510caaf9d6604b2cecf87b78663bc
SHA1 hash:
869a87061f0e2601cb2caf2d5c02107f65a45fc2
Link:
https://www.unpac.me/results/22f3df88-9da5-481e-b73d-5351e8be006e/
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other

Comments