MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6bda1885bb0337153468b0f8bc583130bd259c381b93f810ecb8b03eec8f0675. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Dridex

Vendor detections: 8

Intelligence 8 IOCs YARA 1 File information Comments

SHA256 hash:	6bda1885bb0337153468b0f8bc583130bd259c381b93f810ecb8b03eec8f0675
SHA3-384 hash:	5539880afcda4aa0f49a138148decdf410b4c5818814aab0a3ad0786bf9e34b891aa30f3b433fd216772a62c870cbe88
SHA1 hash:	d83c7e2bb91d996f12fefb49aefcdd8fdcce569e
MD5 hash:	163c3beb5bc72ed9802c1e593f338891
humanhash:	queen-washington-helium-skylark
File name:	pbga113t
Download:	download sample
Signature	Dridex Create hunting rule
File size:	588'288 bytes
First seen:	2020-12-02 13:46:18 UTC
Last seen:	2020-12-02 16:41:29 UTC
File type:	dll
MIME type:	application/x-dosexec
imphash	08e0b65fe472309f668a77535bc9a610 (1 x Dridex)
ssdeep	12288:jITIXWnx4JgwW/DW3ZGjnnuYzxak0uC187lfD6an+SfIJ4C:nM4JmCpQuYzaIlrDKJ4C
Threatray	204 similar samples on MalwareBazaar
TLSH	E1C4D0907253D071E47A08F18C59CBE9C27C3D215E22B5A776CDAE2F8F7049AAD349D2
Reporter	JAMESWT_WT
Tags:	dll Dridex

Intelligence

File Origin

# of uploads :

# of downloads :

247

Origin country :

n/a

Vendor Threat Intelligence

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/106394/

Detection(s):

SecuriteInfo.com.Gen.NN.ZedlaF.34670.Ju8@aKPjzYki.5933.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Sending a UDP request

Sending a custom TCP request

Result

Gathering data

Result

Threat name:

Unknown

Detection:

malicious

Classification:

evad

Score:

48 / 100

Link:

https://www.joesandbox.com/analysis/553595

Signature

Found potential dummy code loops (likely to delay analysis)

Machine Learning detection for sample

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/6bda1885bb0337153468b0f8bc583130bd259c381b93f810ecb8b03eec8f0675/

Threat name:

Win32.Infostealer.Dridex

Status:

Malicious

First seen:

2020-12-02 13:46:40 UTC

File Type:

PE (Dll)

Extracted files:

AV detection:

19 of 28 (67.86%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=npnbrbn3am3rkndiwd4lywbrgc6slhbydoj7qehmxcyd53epaz2q._file

Verdict:

malicious

Label(s):

dridex

Result

Malware family:

dridex

Score:

10/10

Tags:

family:dridex botnet discovery evasion loader trojan

Link:

https://tria.ge/reports/201202-smzpdj3k42/

Behaviour

Suspicious use of WriteProcessMemory

Checks installed software on the system

Checks whether UAC is enabled

Blacklisted process makes network request

Dridex Loader

Dridex

Malware Config

C2 Extraction:

185.59.223.86:443
123.231.252.10:4646
85.25.109.116:3889
91.83.93.89:4643

Unpacked files

SH256 hash:

6bda1885bb0337153468b0f8bc583130bd259c381b93f810ecb8b03eec8f0675

MD5 hash:

163c3beb5bc72ed9802c1e593f338891

SHA1 hash:

d83c7e2bb91d996f12fefb49aefcdd8fdcce569e

Link:

https://www.unpac.me/results/c5965c6d-4c12-4614-9ce8-61fd72ae9f23/

SH256 hash:

bc4c16c4c15e1851e3924ebb4504d6100f14633967d943f343d9e27cc10b0e25

MD5 hash:

a2da4aae96d6d933fa0fe14f28e11a21

SHA1 hash:

acf74512034fd3778e799f81c565b96a62d3e06a

Link:

https://www.unpac.me/results/c5965c6d-4c12-4614-9ce8-61fd72ae9f23/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Trojan

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/6bda1885bb0337153468b0f8bc583130bd259c381b93f810ecb8b03eec8f0675

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.