MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fcd9abcb235ec7aea9a425394952653a57b44ba9233e934289d2b6892fac82b2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Gozi


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: fcd9abcb235ec7aea9a425394952653a57b44ba9233e934289d2b6892fac82b2
SHA3-384 hash: 3502bf0d2ddcdce15a1c7372cbf55ebbbdfaac4c85f5631e5e15cee23ded397a40a5fb714b85ac0cb55a807007b0fec5
SHA1 hash: 09ff86f5dbaab94cef3278cc4801463ebe9cef01
MD5 hash: b0be7de75e36cc4322c757184cc6f3c8
humanhash: fruit-golf-sodium-sweet
File name:ptytmbdu.dll
Download: download sample
Signature Gozi
Create hunting rule
File size:477'696 bytes
First seen:2020-05-06 12:51:57 UTC
Last seen:2020-05-06 14:11:11 UTC
File type:DLL dll
MIME type:application/x-dosexec
imphash 73833e6485e30a01d5ff7d81233eca60 (1 x Gozi)
ssdeep 12288:nFqcBpd4yIqzV+HUdgPEudldjicA3czzJ+rb2Hb79m:Fqc9dz8EgZdJA3czzJ+rqb79m
Threatray 169 similar samples on MalwareBazaar
TLSH 06A48D017691C0B9F66A06BD5E61CAE889287D60DF7880CFB6C83F8F76747D19931722
Reporter James_inthe_box
Tags:dll Gozi

Intelligence

File Origin
# of uploads :
2
# of downloads :
82
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Downloader.Aiis-6803892-0
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Dridex
Create hunting rule
Status:
Malicious
First seen:
2020-05-06 12:51:39 UTC
File Type:
PE (Dll)
Extracted files:
1
AV detection:
22 of 31 (70.97%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
dridex
Create hunting rule
gozi
Create hunting rule
Similar samples:
0a383870010db689605e8aac2fd1a9ad284558ef9eccc6d07bdc9dbbc573480f
Gozi
19042ea0e61783a3c281e3f02e0e2e2b07e9421bae0afeeae21febe450510f0c
Gozi
4655c0216538f752dea2ce1649807d597cd83a935f1385bdd8f418616de97b68
Gozi
5ade0c4492ffe4b77776543635a5cad0eef6d4a207f69dac0a59f9ad76aa42ba
Gozi
75d79cd50c0f3def32be69db58e716d7094006636c8ff9479254ff34224d327e
Gozi
ab44ef41e492f3df1be566ddde081d666b3e9f55ee6f0f195fe0acd4d9701912
Gozi
d3e9f6933d519b6bd1514ceaaa14df64722214c0c6c2a60a6924c92f284b3c08
Gozi
d77234374d79b24022c26ecdd16a684ae7e94efba502422d74852b0eddd4f1b4
Gozi
e9880c5c608141c8ec12ce1a8d14652731583e4055f74ce2727afe8c3ea15cb6
Gozi
f32072d7d581e1a8d04c47b21dafadd58e3dccc3aa0188d7f95f6867944475e0
Gozi
+ 159 additional samples on MalwareBazaar
Result
Malware family:
dridex
Create hunting rule
Score:
  10/10
Tags:
family:dridex botnet discovery evasion loader trojan
Link:
https://tria.ge/reports/201109-edapq7x6j2/
Behaviour
Suspicious use of WriteProcessMemory
Checks installed software on the system
Checks whether UAC is enabled
Blacklisted process makes network request
Dridex Loader
Dridex
Malware Config
C2 Extraction:
38.88.126.131:443
145.239.169.32:8443
163.172.7.152:443
45.79.135.98:691
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other

Comments