MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 27b893ce0883e5a82db4ffb3833e9c0e153c50e53dcc38a96f4a3e3e73f9c4c5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Dridex


Vendor detections: 9


Intelligence 9 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 27b893ce0883e5a82db4ffb3833e9c0e153c50e53dcc38a96f4a3e3e73f9c4c5
SHA3-384 hash: 89d4239414f6f017dba1803ef53dd158ffdf664c2440a2b05ad16adf574e4284ca877abaa52fb64fe880985efad71611
SHA1 hash: 9ef8137c6ee3f3e557db5f7273e3182ee01c7b1b
MD5 hash: fdb4c2455d1331b2dfabc9289a812295
humanhash: alpha-wyoming-yankee-pennsylvania
File name:27b893ce0883e5a82db4ffb3833e9c0e153c50e53dcc38a96f4a3e3e73f9c4c5
Download: download sample
Signature Dridex
Create hunting rule
File size:803'840 bytes
First seen:2021-02-18 11:56:43 UTC
Last seen:2021-02-18 13:36:52 UTC
File type:DLL dll
MIME type:application/x-dosexec
imphash 523b18dc1c7a7f2ecc8f20b6295beddf (15 x Dridex)
ssdeep 12288:EbqkjZG1Vu8MpJYosZUmc16RWdrpo8+FFcLxT8HoxmRsDJteMKT+81MOU7qOkQR1:EbqkjZGqxYjxoArwQobmMKViOUFkK1
Threatray 482 similar samples on MalwareBazaar
TLSH 43058B02B691C025E1B242B9CE66C6FC99397DA1DF6854CBB2C03F9F3A746D19D31623
Reporter Cryptolaemus1
Tags:10444 Dridex


Avatar
Cryptolaemus1
Dridex 10444

Intelligence

File Origin
# of uploads :
2
# of downloads :
115
Origin country :
n/a
Vendor Threat Intelligence
Detection:
DridexLoader
Create hunting rule
Link:
https://www.capesandbox.com/analysis/117760/
Detection(s):
SecuriteInfo.com.ArtemisFDB4C2455D13.11912.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Sending a UDP request
Sending a custom TCP request
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Dridex
Create hunting rule
Detection:
malicious
Classification:
bank.troj.evad
Score:
76 / 100
Link:
https://www.joesandbox.com/analysis/611462
Signature
C2 URLs / IPs found in malware configuration
Detected Dridex e-Banking trojan
Found malware configuration
System process connects to network (likely due to code injection or exploit)
Yara detected Dridex unpacked file
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/27b893ce0883e5a82db4ffb3833e9c0e153c50e53dcc38a96f4a3e3e73f9c4c5/
Threat name:
Win32.Worm.Cridex
Create hunting rule
Status:
Malicious
First seen:
2021-02-18 11:57:12 UTC
AV detection:
19 of 29 (65.52%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=e64jhtqiqps2qlnu76zygpu4byktyuhfhxgdrklpji7d447zytcq._file
Verdict:
malicious
Label(s):
dridex
Create hunting rule
Similar samples:
08770b7ce4f415232f98b641ae609c593dcf6a0907d854fe2acbdbe01c5b6d2c
Dridex
120c3c37af1672c02ce61d7a64795e9cf44146a6e753e5d889c3bfa360d6cd2d
Dridex
24275f73c8faf326ccfe1dff433841bd84a13af9d37bae065585cb8a05589968
Dridex
42ccbdf9c7a08110c9940657d2d0748746c8639d61b7320dc830f70b79948c51
Dridex
4e8b50459a8033a3e81008fe1e01df1997193d59f1012125325ee127281f387d
Dridex
6860b23431c03b24449bf266854150b9a1afe5978b84f53803d446696a0e3621
Dridex
6f7620033e5a6b1283b801c2c97d2bd5dcacb72a2b1ba709b6a763394c6a6aca
Dridex
ba2509192103171273c921d93ddb96478fe2552105aa7dbadddd8138c35ec079
Dridex
e56c7afb6712cd3edda9400e15c8834477a26443575404b22bb92b137289c1b9
Dridex
ff3a35ebb7a529054539464c438c1ac920647e55dac7e8f853cf33c2bfc6da7b
Dridex
+ 472 additional samples on MalwareBazaar
Result
Malware family:
dridex
Create hunting rule
Score:
  10/10
Tags:
family:dridex botnet:10444 botnet discovery evasion loader trojan
Link:
https://tria.ge/reports/210218-mtqfgatldx/
Behaviour
Suspicious use of WriteProcessMemory
Checks installed software on the system
Checks whether UAC is enabled
Blocklisted process makes network request
Dridex Loader
Dridex
Malware Config
C2 Extraction:
209.20.87.138:443
198.1.115.153:8172
151.236.29.248:6516
Unpacked files
SH256 hash:
3fd489ca2819864cae60b2ae12844c1673e501573ba307930886014c9f2b86e8
MD5 hash:
2f17c74c5d0b155f7aa633ee576c9ad4
SHA1 hash:
5b1da405b22b28b4e0b44e92e2d5688597df3db7
Link:
https://www.unpac.me/results/226ad134-826c-48fe-a314-888349351863/
SH256 hash:
27b893ce0883e5a82db4ffb3833e9c0e153c50e53dcc38a96f4a3e3e73f9c4c5
MD5 hash:
fdb4c2455d1331b2dfabc9289a812295
SHA1 hash:
9ef8137c6ee3f3e557db5f7273e3182ee01c7b1b
Link:
https://www.unpac.me/results/226ad134-826c-48fe-a314-888349351863/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/27b893ce0883e5a82db4ffb3833e9c0e153c50e53dcc38a96f4a3e3e73f9c4c5

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DridexLoader
Create hunting rule
Author:kevoreilly
Description:Dridex v4 dropper C2 parsing function
Rule name:win_dridex_loader_v2
Create hunting rule
Author:Johannes Bader @viql
Description:detects some Dridex loaders

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Dridex

DLL dll 27b893ce0883e5a82db4ffb3833e9c0e153c50e53dcc38a96f4a3e3e73f9c4c5

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1016834/
  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/1016107/
  
URLhaus
https://urlhaus.abuse.ch/url/1016145/
  
URLhaus
https://urlhaus.abuse.ch/url/1016730/
Cape
Cape
https://www.capesandbox.com/analysis/117760/

Comments