MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2fc3cb59c6857ff712e6fb5f29536a51962edd2ef374e6f2cd18c9145d275c9f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Dridex

Vendor detections: 7

Intelligence 7 IOCs YARA 1 File information Comments

SHA256 hash:	2fc3cb59c6857ff712e6fb5f29536a51962edd2ef374e6f2cd18c9145d275c9f
SHA3-384 hash:	b5484dbb0e47f2f9999d17e24f7185735b36035b185d81b5aa6106efafc59b05b24a87f7c92a45e7fb4a4dd8633b2bc8
SHA1 hash:	f74266f35ae0432867234867bd8bb55b9664e02d
MD5 hash:	8331bb422758855644314f06ef8b6494
humanhash:	quebec-bakerloo-table-pluto
File name:	hp91tjky.dll
Download:	download sample
Signature	Dridex Create hunting rule
File size:	1'128'960 bytes
First seen:	2020-11-04 19:57:11 UTC
Last seen:	2020-11-04 21:45:13 UTC
File type:	dll
MIME type:	application/x-dosexec
imphash	1f8873f5c04b0f77fa8a0fcbebe9fcf6 (1 x Dridex)
ssdeep	24576:HbIY0sNC3EYVVeU0gUbgv3XPeQNAPRKuzp5JQMDP1pOMNx1rEt:7Ir9N0pA3BNEKyhmoxJEt
Threatray	64 similar samples on MalwareBazaar
TLSH	4835E1503A97C470D0229832CC14DAFD577EBD74AF3146DB32D4AEAF3A705C06A39A66
Reporter	James_inthe_box
Tags:	dll Dridex

Intelligence

File Origin

# of uploads :

# of downloads :

105

Origin country :

n/a

Vendor Threat Intelligence

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/83003/

Detection(s):

SecuriteInfo.com.Artemis8331BB422758.3068.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Sending a custom TCP request

Result

Threat name:

Unknown

Detection:

malicious

Classification:

evad

Score:

64 / 100

Link:

https://www.joesandbox.com/analysis/520708

Signature

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

System process connects to network (likely due to code injection or exploit)

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/2fc3cb59c6857ff712e6fb5f29536a51962edd2ef374e6f2cd18c9145d275c9f/

Threat name:

Win32.Infostealer.Dridex

Status:

Malicious

First seen:

2020-11-04 19:37:46 UTC

File Type:

PE (Dll)

Extracted files:

AV detection:

24 of 29 (82.76%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=f7b4wwogqv77oexg7npssu3kkglc5xjo6n2on4wndderixjhlspq._file

Verdict:

malicious

Label(s):

dridex

Result

Malware family:

dridex

Score:

10/10

Tags:

family:dridex botnet loader

Link:

https://tria.ge/reports/201104-r1sfhzf82s/

Behaviour

Suspicious use of WriteProcessMemory

Dridex Loader

Dridex

Malware Config

C2 Extraction:

193.37.215.79:443
81.2.235.131:1688
178.63.156.139:3388

Unpacked files

SH256 hash:

302d615cc56d2a91c65a23b1f44f898edf6657e3b7c1132807a7c888665765ae

MD5 hash:

84851404aa67a14f0188b76e99ee38ba

SHA1 hash:

127b23c3c850f7d8179cdf9e8c592bd09d444b64

Link:

https://www.unpac.me/results/7f3d7011-bb9b-48e2-abfb-a91001386bba/

SH256 hash:

2fc3cb59c6857ff712e6fb5f29536a51962edd2ef374e6f2cd18c9145d275c9f

MD5 hash:

8331bb422758855644314f06ef8b6494

SHA1 hash:

f74266f35ae0432867234867bd8bb55b9664e02d

Link:

https://www.unpac.me/results/7f3d7011-bb9b-48e2-abfb-a91001386bba/

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.