MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 120c3c37af1672c02ce61d7a64795e9cf44146a6e753e5d889c3bfa360d6cd2d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Dridex


Vendor detections: 9


Intelligence 9 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 120c3c37af1672c02ce61d7a64795e9cf44146a6e753e5d889c3bfa360d6cd2d
SHA3-384 hash: 2d75ad0f423bdb73b4b449e2e3587ae5dff17a37ea636eac92051eb4cdf039f604d8c17a17fa662495debf05ec39b01b
SHA1 hash: 49d6323987c01c2b887101ff493b510229e17428
MD5 hash: 4ee129a17d4714d96f9a56e5f5aeb49f
humanhash: california-king-tennis-ack
File name:120c3c37af1672c02ce61d7a64795e9cf44146a6e753e5d889c3bfa360d6cd2d
Download: download sample
Signature Dridex
Create hunting rule
File size:803'840 bytes
First seen:2021-02-18 11:49:47 UTC
Last seen:2021-02-18 13:36:46 UTC
File type:DLL dll
MIME type:application/x-dosexec
imphash 523b18dc1c7a7f2ecc8f20b6295beddf (15 x Dridex)
ssdeep 12288:kbqkjZS1Vu8MpJYosZUmc16RWdrpo8+FFcLxT8HoxmRsDJteMKTy81MOU7qOkQR1:kbqkjZSqxYjxoArwQobmMKpiOUFkK1
Threatray 471 similar samples on MalwareBazaar
TLSH 78058B02B691C025E1B242B9CE66C6FC99397DA1DF6854CBB2C03F9F3A746D19D31623
Reporter Cryptolaemus1
Tags:10444 Dridex


Avatar
Cryptolaemus1
Dridex 10444

Intelligence

File Origin
# of uploads :
3
# of downloads :
107
Origin country :
n/a
Vendor Threat Intelligence
Detection:
DridexLoader
Create hunting rule
Link:
https://www.capesandbox.com/analysis/117749/
Detection(s):
SecuriteInfo.com.Artemis4EE129A17D47.26012.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Sending a UDP request
Sending a custom TCP request
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Dridex
Create hunting rule
Detection:
malicious
Classification:
bank.troj.evad
Score:
76 / 100
Link:
https://www.joesandbox.com/analysis/611454
Signature
C2 URLs / IPs found in malware configuration
Detected Dridex e-Banking trojan
Found malware configuration
System process connects to network (likely due to code injection or exploit)
Yara detected Dridex unpacked file
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/120c3c37af1672c02ce61d7a64795e9cf44146a6e753e5d889c3bfa360d6cd2d/
Threat name:
Win32.Worm.Cridex
Create hunting rule
Status:
Malicious
First seen:
2021-02-18 11:50:06 UTC
AV detection:
19 of 28 (67.86%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=cigdyn5pczzmalhgdv5gi6k6tt2ecrvg45j6lwejyo72gygwzuwq._file
Verdict:
malicious
Label(s):
dridex
Create hunting rule
Similar samples:
1bb00afe6f0c8a606d68ad4c79bae512de738ca7620e83d95d2a4f5a8172899a
Dridex
42ccbdf9c7a08110c9940657d2d0748746c8639d61b7320dc830f70b79948c51
Dridex
582f062af319c7e2f23be49d321125334f497b9eebe9ac997bbd00d883020e68
Dridex
5d7876b31409ed18956931b9703559b9c7154a3285ef466f34723e996e8709ca
Dridex
761b4aaf41e86d04218bdeeb08c089b4ec6a18b552df1bc666482ee265db7b07
Dridex
7868012750d3466da79a88146b42b2dd71d95b7c6c2e9f6d1fc49270f23d4f31
Dridex
8195c0e6b5bd6b39c5b8aec47f10a973501ba9a9dc17967141545fda31a7188e
Dridex
bc1d978695e3dc1666923fa13de923870a7604375d57bb6771e2f4bcd8ae8d56
Dridex
ca3589b42f6824dcb932812d91cf0e4e8e2186c85d60777e697d0f45e6d6da27
Dridex
e21e27fda96e53f7102ce676de46f464d0ee21341365c161facc2f42807ce1e3
Dridex
+ 461 additional samples on MalwareBazaar
Result
Malware family:
dridex
Create hunting rule
Score:
  10/10
Tags:
family:dridex botnet:10444 botnet discovery evasion loader trojan
Link:
https://tria.ge/reports/210218-nyafsfdtss/
Behaviour
Suspicious use of WriteProcessMemory
Checks installed software on the system
Checks whether UAC is enabled
Blocklisted process makes network request
Dridex Loader
Dridex
Malware Config
C2 Extraction:
209.20.87.138:443
198.1.115.153:8172
151.236.29.248:6516
Unpacked files
SH256 hash:
6ad8cd32fa1cd6ddae079f6c361b6ef1bda24a441c34c9b18550eb866d68c844
MD5 hash:
f5e829408ca82b3908c43f8585822bce
SHA1 hash:
dad1844e030d33b488a79f76b8564cd0f66f8693
Link:
https://www.unpac.me/results/1dd42801-511d-427b-a148-f5d3c119353c/
SH256 hash:
120c3c37af1672c02ce61d7a64795e9cf44146a6e753e5d889c3bfa360d6cd2d
MD5 hash:
4ee129a17d4714d96f9a56e5f5aeb49f
SHA1 hash:
49d6323987c01c2b887101ff493b510229e17428
Link:
https://www.unpac.me/results/1dd42801-511d-427b-a148-f5d3c119353c/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/120c3c37af1672c02ce61d7a64795e9cf44146a6e753e5d889c3bfa360d6cd2d

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DridexLoader
Create hunting rule
Author:kevoreilly
Description:Dridex v4 dropper C2 parsing function
Rule name:win_dridex_loader_v2
Create hunting rule
Author:Johannes Bader @viql
Description:detects some Dridex loaders

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Dridex

DLL dll 120c3c37af1672c02ce61d7a64795e9cf44146a6e753e5d889c3bfa360d6cd2d

(this sample)

Cape
Cape
https://www.capesandbox.com/analysis/117749/
  
URLhaus
https://urlhaus.abuse.ch/url/1016768/
  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/1016762/
  
URLhaus
https://urlhaus.abuse.ch/url/1016831/
  
URLhaus
https://urlhaus.abuse.ch/url/1016810/

Comments