MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6b34671b04872cfde098c319f20693021a43ddb8b00f989669778e745e5232a4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Dridex

Vendor detections: 6

Intelligence 6 IOCs YARA 2 File information Comments

SHA256 hash:	6b34671b04872cfde098c319f20693021a43ddb8b00f989669778e745e5232a4
SHA3-384 hash:	d3f9b7defc903fd7743774ea02ed43f7c4b42500905a7897f6ae32480617192f6ff694cef0b8866e27dd816e84f9e620
SHA1 hash:	77f7f1ffb9757dde690dd3466af59f171875a9f4
MD5 hash:	dcf2227479f4f2a37f4ffdfc7c4b1f0f
humanhash:	kilo-sink-mississippi-low
File name:	gtx5mrkw5rar
Download:	download sample
Signature	Dridex Create hunting rule
File size:	400'896 bytes
First seen:	2020-10-21 09:45:49 UTC
Last seen:	Never
File type:	dll
MIME type:	application/x-dosexec
imphash	1e765f1d5302b9c12f7792f1f6be3c79 (2 x Dridex)
ssdeep	6144:1BSHKLXmp/jzFmNr9bzxJ9mFCSMTawWTe80RxH4C6X6CBJ4:Q/jGrRlJAFCSMGhC806qCz
Threatray	25 similar samples on MalwareBazaar
TLSH	C1849D617677F89EF93422B1BAD31CE9F1AC962C385C3C63CD538805894A27A5CD660F
Reporter	JAMESWT_WT
Tags:	Dridex

Intelligence

File Origin

# of uploads :

# of downloads :

124

Origin country :

n/a

Vendor Threat Intelligence

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/73945/

Result

Verdict:

Malware

Maliciousness:

Behaviour

Sending a custom TCP request

Result

Threat name:

Unknown

Detection:

malicious

Classification:

n/a

Score:

52 / 100

Link:

https://www.joesandbox.com/analysis/505565

Signature

Machine Learning detection for sample

Multi AV Scanner detection for submitted file

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/6b34671b04872cfde098c319f20693021a43ddb8b00f989669778e745e5232a4/

Threat name:

Win32.Infostealer.Dridex

Status:

Malicious

First seen:

2020-10-21 09:47:04 UTC

File Type:

PE (Dll)

Extracted files:

AV detection:

23 of 29 (79.31%)

Threat level:

5/5

Verdict:

malicious

Label(s):

dridex

Result

Malware family:

dridex

Score:

10/10

Tags:

botnet loader evasion trojan discovery family:dridex

Link:

https://tria.ge/reports/201021-81hz6f4la6/

Behaviour

Suspicious use of WriteProcessMemory

Checks installed software on the system

Checks whether UAC is enabled

Blacklisted process makes network request

Dridex Loader

Dridex

Malware Config

C2 Extraction:

79.137.29.86:443
87.106.191.77:3889
44.48.26.99:4664
178.254.22.25:33443

Unpacked files

SH256 hash:

d5836dd1fe798110d9526f19d73a10be52d5ee2f114966f12cbe6cf5cf7c302c

MD5 hash:

bb0770c71c19e4f35d95e65e46553618

SHA1 hash:

f95d7f51e4d8e443b9a7e9cd4858c876bd244282

Link:

https://www.unpac.me/results/55a49ed8-6508-4091-a6cb-bb596f4883a7/

SH256 hash:

6b34671b04872cfde098c319f20693021a43ddb8b00f989669778e745e5232a4

MD5 hash:

dcf2227479f4f2a37f4ffdfc7c4b1f0f

SHA1 hash:

77f7f1ffb9757dde690dd3466af59f171875a9f4

Link:

https://www.unpac.me/results/55a49ed8-6508-4091-a6cb-bb596f4883a7/

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.