MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 651a3240a51791a9a14b5df4c42b676442c9d790410bdb083407fa15cf990f83. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Dridex

Vendor detections: 6

Intelligence 6 IOCs YARA 2 File information Comments

SHA256 hash:	651a3240a51791a9a14b5df4c42b676442c9d790410bdb083407fa15cf990f83
SHA3-384 hash:	0666350a79c977bf7b3388863b6f7c4615ff6469cf08d7905299af5d478b0683b077288739bc068b8639ba577f73d56c
SHA1 hash:	1e8423d909ae08fa9a5a7ec474884aa1c72f1828
MD5 hash:	2b64b8df419b95739f4ee8c19c9eebea
humanhash:	may-pip-golf-apart
File name:	651a3240a51791a9a14b5df4c42b676442c9d790410bdb083407fa15cf990f83
Download:	download sample
Signature	Dridex Create hunting rule
File size:	638'464 bytes
First seen:	2021-03-01 18:21:41 UTC
Last seen:	2021-03-01 20:12:36 UTC
File type:	dll
MIME type:	application/x-dosexec
imphash	3c0860a13c678470735290ac333e3e38 (5 x Dridex)
ssdeep	6144:YLExaqvRuqh931pIwuZ0/GBzqiH859y1gH67QTy6zmBIyT/acyB0cht0drWxyFSI:YLE0fqhtc05I1h6yi2Iyuh/toWWp
Threatray	497 similar samples on MalwareBazaar
TLSH	FAD4382AF596C0A2D76851B49CA4FEFD8AC53C58CCA080537ED71F0F762E6139B6113A
Reporter	Cryptolaemus1
Tags:	10444 Dridex

Cryptolaemus1

Dridex 10444

Intelligence

File Origin

# of uploads :

# of downloads :

116

Origin country :

n/a

Vendor Threat Intelligence

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/120359/

Detection(s):

SecuriteInfo.com.Program.13898.14137.UNOFFICIAL

Result

Verdict:

Clean

Maliciousness:

Behaviour

Sending a UDP request

Sending a custom TCP request

Result

Verdict:

UNKNOWN

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/651a3240a51791a9a14b5df4c42b676442c9d790410bdb083407fa15cf990f83/

Threat name:

Win32.Worm.Cridex

Status:

Malicious

First seen:

2021-03-01 18:22:13 UTC

AV detection:

8 of 29 (27.59%)

Threat level:

5/5

Verdict:

malicious

Label(s):

dridex

gozi

Result

Malware family:

dridex

Score:

10/10

Tags:

family:dridex botnet:10444 botnet loader

Link:

https://tria.ge/reports/210301-lb4agtxw42/

Behaviour

Suspicious use of WriteProcessMemory

Dridex Loader

Dridex

Malware Config

C2 Extraction:

77.220.64.146:443
85.25.134.43:8172
213.208.134.178:6516

Unpacked files

SH256 hash:

5539d62e243c5748f35d7ee93e2335a4b340b02b411e0dce8892a8edc0c543ce

MD5 hash:

f0f7fec7db1dca1e99934ff870220918

SHA1 hash:

bb002d064ae53d54cea3472b66f771d0343bcdd8

Link:

https://www.unpac.me/results/51935122-b182-497f-bd46-3f2cb9e142c1/

SH256 hash:

651a3240a51791a9a14b5df4c42b676442c9d790410bdb083407fa15cf990f83

MD5 hash:

2b64b8df419b95739f4ee8c19c9eebea

SHA1 hash:

1e8423d909ae08fa9a5a7ec474884aa1c72f1828

Link:

https://www.unpac.me/results/51935122-b182-497f-bd46-3f2cb9e142c1/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/651a3240a51791a9a14b5df4c42b676442c9d790410bdb083407fa15cf990f83

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.