MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4f274c3735228530f821d63949e0cf14f39c162c143f1465fb3b8585b4315be1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Dridex


Vendor detections: 8


Intelligence 8 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4f274c3735228530f821d63949e0cf14f39c162c143f1465fb3b8585b4315be1
SHA3-384 hash: 4a035ff49eeacd9c48e7b0aa661cc0d84832533ba8e33955cb068974b46cf5e5cf5435382409d09f4c6674aa181baa16
SHA1 hash: ae9ca7ddbf4c9a1f74196960f1e89dd877e2e727
MD5 hash: aed1a890a539ff4715446cd2ddb9cdf1
humanhash: pluto-fillet-avocado-zulu
File name:ktyedjx6x.dll
Download: download sample
Signature Dridex
Create hunting rule
File size:497'664 bytes
First seen:2021-01-27 14:22:36 UTC
Last seen:2021-01-27 16:12:24 UTC
File type:DLL dll
MIME type:application/x-dosexec
imphash d74103cb2b399d1ff0305ba35eef8c9f (20 x Dridex)
ssdeep 12288:IELC62WDPaiGYQHZ9TR2sDxEUW1ZdGOLZvFr:IEV2kCimZFR2sD2zpZvd
Threatray 374 similar samples on MalwareBazaar
TLSH E0B49E22EA946434F71D13305CA7E8A646FDBC04866DED5B32DF2D4B38A6372B05638D
Reporter JAMESWT_WT
Tags:dll Dridex

Intelligence

File Origin
# of uploads :
2
# of downloads :
156
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/114086/
Detection(s):
SecuriteInfo.com.ArtemisAED1A890A539.12870.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
Sending a custom TCP request
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Dridex
Create hunting rule
Detection:
malicious
Classification:
bank.evad
Score:
64 / 100
Link:
https://www.joesandbox.com/analysis/591898
Signature
Detected Dridex e-Banking trojan
Found malware configuration
System process connects to network (likely due to code injection or exploit)
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4f274c3735228530f821d63949e0cf14f39c162c143f1465fb3b8585b4315be1/
Threat name:
Win32.Worm.Cridex
Create hunting rule
Status:
Malicious
First seen:
2021-01-27 14:23:04 UTC
File Type:
PE (Dll)
Extracted files:
1
AV detection:
12 of 28 (42.86%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=j4tuynzvekctb6bb2y4utygpctzzyfrmcq7rizp3hocylnbrlpqq._file
Verdict:
malicious
Label(s):
dridex
Create hunting rule
Similar samples:
2c36cb4e1771a04e728d75eb65b05f6875d4eb56df6eb5810af09d0d5e419cd5
Dridex
2fc3cb59c6857ff712e6fb5f29536a51962edd2ef374e6f2cd18c9145d275c9f
Dridex
656e8cfb9d183adf792ed933c5c177190f10064cbff62090977f2174cce9df0d
Dridex
658462a79e56950bc3c51c65743f3aa153322c138ab95fc60cee0e3f92aa7bad
Dridex
68e33e85ff85d6eb4866afeb1161136dc3f0d974673796a6f92ce5665a924b3f
Dridex
79a3a7441a371606291f8bd47216a503b27a38ec61ba7604c9ba2597a54cc3d8
Dridex
88b2bb4d5426b3d60dc02ab3c1732108a426d366fa3f4e5d51b2445fd1afa19d
Dridex
b7ab5a09792860c1c1ed7771ad1b8641bce13fadf401c56be159ad3219ebf3bc
Dridex
c9543baa2ba0d7d8b670213c02ba258041823cf79f558a3c7e4c9ad7923b2bc3
Dridex
fc8724525d089bab1e6259f660fd4a36f7e54caf2aa3a39410b858381af8dabd
Dridex
+ 364 additional samples on MalwareBazaar
Result
Malware family:
dridex
Create hunting rule
Score:
  10/10
Tags:
family:dridex botnet loader
Link:
https://tria.ge/reports/210127-6a6v5n6vs6/
Behaviour
Suspicious use of WriteProcessMemory
Dridex Loader
Dridex
Malware Config
C2 Extraction:
193.90.12.20:443
185.181.9.76:5037
175.207.13.56:5353
212.129.24.84:5037
Unpacked files
SH256 hash:
620e4db76a3553efc895090ded19376d4554adf313426a005d8271ed945a38db
MD5 hash:
7dfa788438c9125dbe8dcf78be9316fa
SHA1 hash:
e4f82bbdca2b3a49af9fb25dc3e1cfc7d4304760
Link:
https://www.unpac.me/results/1f4e2f83-2bf5-41d6-a539-4c7b42f76436/
SH256 hash:
4f274c3735228530f821d63949e0cf14f39c162c143f1465fb3b8585b4315be1
MD5 hash:
aed1a890a539ff4715446cd2ddb9cdf1
SHA1 hash:
ae9ca7ddbf4c9a1f74196960f1e89dd877e2e727
Link:
https://www.unpac.me/results/1f4e2f83-2bf5-41d6-a539-4c7b42f76436/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Trojan
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/4f274c3735228530f821d63949e0cf14f39c162c143f1465fb3b8585b4315be1

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DridexLoader
Create hunting rule
Author:kevoreilly
Description:Dridex v4 dropper C2 parsing function
Rule name:win_dridex_loader_v2
Create hunting rule
Author:Johannes Bader @viql
Description:detects some Dridex loaders

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Dridex

DLL dll 4f274c3735228530f821d63949e0cf14f39c162c143f1465fb3b8585b4315be1

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/980270/
  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/980280/
  
URLhaus
https://urlhaus.abuse.ch/url/980468/
  
URLhaus
https://urlhaus.abuse.ch/url/980489/
  
URLhaus
https://urlhaus.abuse.ch/url/980492/
  
URLhaus
https://urlhaus.abuse.ch/url/980508/
Cape
Cape
https://www.capesandbox.com/analysis/114086/

Comments