MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 39dec3601ada3ff7c2a8a25597c8eeb8892edf00fa040c3518da570ad39a561c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Dridex

Vendor detections: 7

Intelligence 7 IOCs YARA 2 File information Comments

SHA256 hash:	39dec3601ada3ff7c2a8a25597c8eeb8892edf00fa040c3518da570ad39a561c
SHA3-384 hash:	24af4b8427fb54df0a5a4247e21541fadd0df19971304c1c59675749b8fdc442d8b24df3aeffbea884e6d1fcfa1bb682
SHA1 hash:	276de1b9e369364b647f756c0d4bf3c1d9d2be13
MD5 hash:	7ec994f32bcfb841a26dbc855a80ccf6
humanhash:	four-mountain-salami-nineteen
File name:	39dec3601ada3ff7c2a8a25597c8eeb8892edf00fa040c3518da570ad39a561c
Download:	download sample
Signature	Dridex Create hunting rule
File size:	389'632 bytes
First seen:	2021-04-01 02:18:58 UTC
Last seen:	Never
File type:	dll
MIME type:	application/x-dosexec
imphash	61ef004a8c2946a166c67bb888b0e53e (10 x Dridex)
ssdeep	6144:pOhxWpCcRexubjJ/WNQoGuBF4CEejyK0nnTaftjWnFGLOk0zEj/LbOc+gpHU:pOKcubjNA5BFiTaFjaPcHOcjpHU
Threatray	734 similar samples on MalwareBazaar
TLSH	A784D143ABD54472F6721F3804739B104BEFBDD64E308DAA6289211D2F673C196787AB
Reporter	Cryptolaemus1
Tags:	10444 Dridex

Cryptolaemus1

Dridex 10444

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Detection:

DridexLoader

Link:

https://www.capesandbox.com/analysis/130396/

Detection(s):

SecuriteInfo.com.W32.AIDetect.malware2.2641.21104.UNOFFICIAL

Result

Verdict:

Clean

Maliciousness:

Behaviour

Sending a UDP request

Sending a custom TCP request

Result

Verdict:

UNKNOWN

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Result

Threat name:

Dridex

Detection:

malicious

Classification:

bank.troj.evad

Score:

88 / 100

Link:

https://www.joesandbox.com/analysis/661332

Signature

C2 URLs / IPs found in malware configuration

Detected Dridex e-Banking trojan

Found malware configuration

Machine Learning detection for sample

Multi AV Scanner detection for submitted file

System process connects to network (likely due to code injection or exploit)

Yara detected Dridex unpacked file

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/39dec3601ada3ff7c2a8a25597c8eeb8892edf00fa040c3518da570ad39a561c/

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=hhpmgya23i77pqviujkzpshoxces5xya7icayniy3jlqvu42kyoa._file

Verdict:

malicious

Label(s):

dridex

gozi

Result

Malware family:

dridex

Score:

10/10

Tags:

family:dridex botnet:10444 botnet discovery evasion loader trojan

Link:

https://tria.ge/reports/210401-ahrevjb9gn/

Behaviour

Suspicious use of WriteProcessMemory

Checks installed software on the system

Checks whether UAC is enabled

Blocklisted process makes network request

Dridex Loader

Dridex

Malware Config

C2 Extraction:

131.100.24.215:443
210.65.244.174:6601
195.201.199.53:2303

Unpacked files

SH256 hash:

bab50767a3f8626bea5b7c1fb43d723937c6713648c94f74a0e84a69fb17c926

MD5 hash:

e713592dc70f01cdb8280ab0cfc54bad

SHA1 hash:

788a79188313fc54dd18a14320572e11f39b8ac3

Link:

https://www.unpac.me/results/602083c9-42e3-4e1a-8981-7d3631b69035/

SH256 hash:

39dec3601ada3ff7c2a8a25597c8eeb8892edf00fa040c3518da570ad39a561c

MD5 hash:

7ec994f32bcfb841a26dbc855a80ccf6

SHA1 hash:

276de1b9e369364b647f756c0d4bf3c1d9d2be13

Link:

https://www.unpac.me/results/602083c9-42e3-4e1a-8981-7d3631b69035/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/39dec3601ada3ff7c2a8a25597c8eeb8892edf00fa040c3518da570ad39a561c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.