MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6df3e9aef37c9d227428dc5d745fb5ef79120ad0439120e68b00b0b4daa63da6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Dridex

Vendor detections: 8

Intelligence 8 IOCs YARA 2 File information Comments

SHA256 hash:	6df3e9aef37c9d227428dc5d745fb5ef79120ad0439120e68b00b0b4daa63da6
SHA3-384 hash:	2cb8d2d29dc145c7ea7751c457f6fc25272d94e1c8a59c1e90dabd45a9bf6210d63bd69c6b929c994828078343ae0b4d
SHA1 hash:	930de4b1385d278ac3187d3e1593e68247379536
MD5 hash:	959278f5111788de07a06b71039bad6c
humanhash:	utah-paris-orange-item
File name:	6df3e9aef37c9d227428dc5d745fb5ef79120ad0439120e68b00b0b4daa63da6
Download:	download sample
Signature	Dridex Create hunting rule
File size:	860'672 bytes
First seen:	2021-03-10 13:44:28 UTC
Last seen:	2021-03-10 16:18:27 UTC
File type:	dll
MIME type:	application/x-dosexec
imphash	527152ae4f410782dd90815c751a0c7b (6 x Dridex)
ssdeep	6144:mlCL0jB+qQPDS7Eg7BIoWzdk6N3QgqMyTm1m9/w4EuFBuqcVA+910kh5:m00jB+qqu7EhoQi6N371cRuqcVAO10W
Threatray	495 similar samples on MalwareBazaar
TLSH	AB05C4523A41F8A1F2282632CF21C5FC2B547C19DFB4596372E62F1F3AADDA795003A5
Reporter	Cryptolaemus1
Tags:	10444 Dridex

Cryptolaemus1

Dridex 10444

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Detection:

DridexLoader

Link:

https://www.capesandbox.com/analysis/123633/

Detection(s):

SecuriteInfo.com.ML.PE-A.32450.13017.UNOFFICIAL

Result

Verdict:

Clean

Maliciousness:

Behaviour

Sending a UDP request

Result

Verdict:

UNKNOWN

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Gathering data

Threat name:

Win32.Trojan.Generic

Status:

Suspicious

First seen:

2021-03-10 13:45:09 UTC

File Type:

PE (Dll)

Extracted files:

AV detection:

9 of 27 (33.33%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=nxz6tlxtpsose5bi3roxix5v554recwqioisbzulacyljwvghwta._file

Verdict:

malicious

Label(s):

dridex

gozi

Result

Malware family:

dridex

Score:

10/10

Tags:

family:dridex botnet:10444 botnet loader

Link:

https://tria.ge/reports/210310-21xzt4h7ls/

Behaviour

Suspicious use of WriteProcessMemory

Dridex Loader

Dridex

Malware Config

C2 Extraction:

210.65.244.166:443
178.33.183.53:7443
157.7.139.198:6601

Unpacked files

SH256 hash:

8d69bca552dc08f50828f5a81f3d80912782b94328fbbf3282855cb7e124e38a

MD5 hash:

cf656a98f90e7b32e65841ba650649b8

SHA1 hash:

10cc6cede1de8f1815c6cc7b6d9006e5eae90dd9

Link:

https://www.unpac.me/results/b7e5901d-c2e5-4e4f-9670-78fd333bb19f/

SH256 hash:

6df3e9aef37c9d227428dc5d745fb5ef79120ad0439120e68b00b0b4daa63da6

MD5 hash:

959278f5111788de07a06b71039bad6c

SHA1 hash:

930de4b1385d278ac3187d3e1593e68247379536

Link:

https://www.unpac.me/results/b7e5901d-c2e5-4e4f-9670-78fd333bb19f/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/6df3e9aef37c9d227428dc5d745fb5ef79120ad0439120e68b00b0b4daa63da6

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.