MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6277d651c62eac2a706b7a0d027bc4fe91a3b360453e1c3c99ff1fe287ab1dff. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Dridex

Vendor detections: 7

Intelligence 7 IOCs YARA 2 File information Comments

SHA256 hash:	6277d651c62eac2a706b7a0d027bc4fe91a3b360453e1c3c99ff1fe287ab1dff
SHA3-384 hash:	5399177bbcbff614fac3edcfad7b082877888dd2f12cedbd7c973247857c40f876a1c9fba8db8ea112f02ec6a302a453
SHA1 hash:	d44b402298e72b788c116cae0cb28e830be9e84e
MD5 hash:	1273a9b06f4a949383dc7e14d2cfd435
humanhash:	yankee-dakota-robert-golf
File name:	6277d651c62eac2a706b7a0d027bc4fe91a3b360453e1c3c99ff1fe287ab1dff
Download:	download sample
Signature	Dridex Create hunting rule
File size:	638'464 bytes
First seen:	2021-03-01 18:21:53 UTC
Last seen:	2021-03-01 20:12:38 UTC
File type:	dll
MIME type:	application/x-dosexec
imphash	3c0860a13c678470735290ac333e3e38 (5 x Dridex)
ssdeep	6144:0LExaqvRuqh931pIwuZ0/GBzqiH859y1gH67QTy6zmBIsQ/acyB0cht0drJxyFSI:0LE0fqhtc05I1h6yi2Isth/toJWp
Threatray	498 similar samples on MalwareBazaar
TLSH	7AD4382AF596C0A2D76851B49CA4FEFD8AC53C58CCA080537ED71F0F762E6139B6113A
Reporter	Cryptolaemus1
Tags:	10444 Dridex

Cryptolaemus1

Dridex 10444

Intelligence

File Origin

# of uploads :

# of downloads :

114

Origin country :

n/a

Vendor Threat Intelligence

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/120361/

Detection(s):

SecuriteInfo.com.generic.ml.4985.6503.UNOFFICIAL

Result

Verdict:

Clean

Maliciousness:

Behaviour

Sending a UDP request

Sending a custom TCP request

Result

Verdict:

UNKNOWN

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/6277d651c62eac2a706b7a0d027bc4fe91a3b360453e1c3c99ff1fe287ab1dff/

Threat name:

Win32.Worm.Cridex

Status:

Malicious

First seen:

2021-03-01 18:22:14 UTC

AV detection:

9 of 29 (31.03%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=mj35muogf2wcu4dlpigqe66e72i2hm3aiu7bypez74p6fb5ldx7q._file

Verdict:

malicious

Label(s):

dridex

gozi

Result

Malware family:

dridex

Score:

10/10

Tags:

family:dridex botnet:10444 botnet loader

Link:

https://tria.ge/reports/210301-rldhxgwtb2/

Behaviour

Suspicious use of WriteProcessMemory

Dridex Loader

Dridex

Malware Config

C2 Extraction:

77.220.64.146:443
85.25.134.43:8172
213.208.134.178:6516

Unpacked files

SH256 hash:

1c64fb320968fecc54ef38d53c3534e4153ab35e3a4568b46fcc0679f42a06ff

MD5 hash:

c1696dae7fb3c238449a2ef316fd34c2

SHA1 hash:

fdbef564d368c852b0dd4acdeff3353cfe06bddd

Link:

https://www.unpac.me/results/dca1b608-1cbd-4a21-8231-4cf420e0ff11/

SH256 hash:

6277d651c62eac2a706b7a0d027bc4fe91a3b360453e1c3c99ff1fe287ab1dff

MD5 hash:

1273a9b06f4a949383dc7e14d2cfd435

SHA1 hash:

d44b402298e72b788c116cae0cb28e830be9e84e

Link:

https://www.unpac.me/results/dca1b608-1cbd-4a21-8231-4cf420e0ff11/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/6277d651c62eac2a706b7a0d027bc4fe91a3b360453e1c3c99ff1fe287ab1dff

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.