MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 10270594d0719028a337eacdecc282885990ead35dff29781b25a86200d36f95. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Dridex

Vendor detections: 8

Intelligence 8 IOCs YARA 2 File information Comments

SHA256 hash:	10270594d0719028a337eacdecc282885990ead35dff29781b25a86200d36f95
SHA3-384 hash:	d9f4defef6d1f9889f227d0aa5ac0ae3cc65fb2d1d65cdfcee356b44e96b0650ee1680ebed82997ff43f6cf7caf0891c
SHA1 hash:	9996f0c3bf03269a9ae5b38f975a4466b3da89e8
MD5 hash:	39b34c28ed8dbbc6ad137537d53a7ace
humanhash:	salami-nebraska-alaska-texas
File name:	10270594d0719028a337eacdecc282885990ead35dff29781b25a86200d36f95
Download:	download sample
Signature	Dridex Create hunting rule
File size:	832'512 bytes
First seen:	2021-03-15 12:24:19 UTC
Last seen:	2021-03-15 13:43:47 UTC
File type:	dll
MIME type:	application/x-dosexec
imphash	aea7cd92e8d54732bbabf352b513d261 (6 x Dridex)
ssdeep	12288:Zqdbh4CmnCnGeFkc0gajgAEvK9VBG6OearhLp46Y/lSRfsXJ:g97nXFGgiCU/oY6q
Threatray	515 similar samples on MalwareBazaar
TLSH	6C05DF51B983EA39C44994B5CE5CC9FE880DBF85CF662A4774C8BF9F73302689539028
Reporter	Cryptolaemus1
Tags:	10444 Dridex

Cryptolaemus1

Dridex 10444

Intelligence

File Origin

# of uploads :

# of downloads :

127

Origin country :

n/a

Vendor Threat Intelligence

Detection(s):

SecuriteInfo.com.BScope.TrojanSpy.Zbot.5188.3481.UNOFFICIAL

Result

Verdict:

Clean

Maliciousness:

Behaviour

Sending a UDP request

Sending a custom TCP request

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Result

Threat name:

Dridex

Detection:

malicious

Classification:

troj

Score:

60 / 100

Link:

https://www.joesandbox.com/analysis/639416

Signature

C2 URLs / IPs found in malware configuration

Found malware configuration

Yara detected Dridex unpacked file

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/10270594d0719028a337eacdecc282885990ead35dff29781b25a86200d36f95/

Threat name:

Win32.Infostealer.Dridex

Status:

Malicious

First seen:

2021-03-15 12:25:07 UTC

File Type:

PE (Dll)

AV detection:

11 of 28 (39.29%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=catqlfgqogicrizx5lg6zqucrbmzb2wtlx7ss6a3ewugeagtn6kq._file

Verdict:

malicious

Label(s):

dridex

Result

Malware family:

dridex

Score:

10/10

Tags:

family:dridex botnet:10444 botnet discovery evasion loader trojan

Link:

https://tria.ge/reports/210315-zxr68myqja/

Behaviour

Suspicious use of WriteProcessMemory

Checks installed software on the system

Checks whether UAC is enabled

Blocklisted process makes network request

Dridex Loader

Dridex

Malware Config

C2 Extraction:

210.65.244.184:443
147.78.186.4:10051
62.75.168.152:6601

Unpacked files

SH256 hash:

abda04663aa0bedf04db504d3964860cef6c7a4b1a790c4468f2c59110b7351d

MD5 hash:

57218f34780140f8734a829c0290b08e

SHA1 hash:

0d6301ed8ea3c3b7b50410c72f16bf7071140035

Link:

https://www.unpac.me/results/17794689-c6c1-4983-b1fb-2d376fd14638/

SH256 hash:

10270594d0719028a337eacdecc282885990ead35dff29781b25a86200d36f95

MD5 hash:

39b34c28ed8dbbc6ad137537d53a7ace

SHA1 hash:

9996f0c3bf03269a9ae5b38f975a4466b3da89e8

Link:

https://www.unpac.me/results/17794689-c6c1-4983-b1fb-2d376fd14638/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/10270594d0719028a337eacdecc282885990ead35dff29781b25a86200d36f95

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.