MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7d16b486189c010f74ad58e73a5c6acbd38c4f502d1ed5b52d611d9956a53df2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Dridex

Vendor detections: 7

Intelligence 7 IOCs YARA 2 File information Comments

SHA256 hash:	7d16b486189c010f74ad58e73a5c6acbd38c4f502d1ed5b52d611d9956a53df2
SHA3-384 hash:	6b0670206ad09c713c0ea7d8c569a0d8f5ea95d304141670e3c7430481eb2b3811f876482f5e99eb1639b22464737431
SHA1 hash:	13d2db72cd29a4bdcc6af3cbf198e8e67b63f90f
MD5 hash:	9c9e5f27fd0f4d044e4d9d6c89fe8216
humanhash:	stairway-october-beer-white
File name:	7d16b486189c010f74ad58e73a5c6acbd38c4f502d1ed5b52d611d9956a53df2
Download:	download sample
Signature	Dridex Create hunting rule
File size:	875'008 bytes
First seen:	2021-03-15 13:46:06 UTC
Last seen:	2021-03-15 15:38:21 UTC
File type:	dll
MIME type:	application/x-dosexec
imphash	8a9ec00278fff16cc5a360b036ba842b (6 x Dridex)
ssdeep	12288:QYSRzYd+T4RrhYZ1TBWHiCnRay0FeShnU1Z5KqlBXI8JqjaD4xg1v:P7d+T4RrijcHiga3g6sb8jw4K
Threatray	518 similar samples on MalwareBazaar
TLSH	AF15DF42B552EA78C84584F6CEACCDFE4A0DBF96CE292A4770C6BF4F33701A45538529
Reporter	Cryptolaemus1
Tags:	10444 Dridex

Cryptolaemus1

Dridex 10444

Intelligence

File Origin

# of uploads :

# of downloads :

128

Origin country :

n/a

Vendor Threat Intelligence

Detection(s):

SecuriteInfo.com.Trojan.Win32.Save.a.30214.9955.UNOFFICIAL

Result

Verdict:

Clean

Maliciousness:

Behaviour

Sending a UDP request

Sending a custom TCP request

Result

Verdict:

UNKNOWN

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Verdict:

Suspicious

Link:

https://analyze.intezer.com/analyses/55f48a21-8269-4390-9784-c4d7d59339cd

Result

Threat name:

Dridex

Detection:

malicious

Classification:

troj.evad

Score:

64 / 100

Link:

https://www.joesandbox.com/analysis/639556

Signature

C2 URLs / IPs found in malware configuration

Found malware configuration

Found potential dummy code loops (likely to delay analysis)

Yara detected Dridex unpacked file

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/7d16b486189c010f74ad58e73a5c6acbd38c4f502d1ed5b52d611d9956a53df2/

Threat name:

Win32.Trojan.Malrep

Status:

Malicious

First seen:

2021-03-15 13:47:07 UTC

File Type:

PE (Dll)

Extracted files:

AV detection:

11 of 28 (39.29%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=pulljbqytqaq65fnldttuxdkzpjyyt2qfupnlnjnmeozsvvfhxza._file

Verdict:

malicious

Label(s):

dridex

Result

Malware family:

dridex

Score:

10/10

Tags:

family:dridex botnet:10444 botnet discovery evasion loader trojan

Link:

https://tria.ge/reports/210315-vfnt1w9mn2/

Behaviour

Suspicious use of WriteProcessMemory

Checks installed software on the system

Checks whether UAC is enabled

Blocklisted process makes network request

Dridex Loader

Dridex

Malware Config

C2 Extraction:

210.65.244.184:443
147.78.186.4:10051
62.75.168.152:6601

Unpacked files

SH256 hash:

18877fa19d3f235ffda9dfbf30390495aee83997fff54163697e0eac5f2f8a8c

MD5 hash:

0c96198bc2b75446caae1fd98cedfa9b

SHA1 hash:

776a41297ea24f980abc0c44a4b79f48a6e8fe5b

Link:

https://www.unpac.me/results/250c20b8-cfe9-4f28-b2a0-bd33b1073915/

SH256 hash:

7d16b486189c010f74ad58e73a5c6acbd38c4f502d1ed5b52d611d9956a53df2

MD5 hash:

9c9e5f27fd0f4d044e4d9d6c89fe8216

SHA1 hash:

13d2db72cd29a4bdcc6af3cbf198e8e67b63f90f

Link:

https://www.unpac.me/results/250c20b8-cfe9-4f28-b2a0-bd33b1073915/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/7d16b486189c010f74ad58e73a5c6acbd38c4f502d1ed5b52d611d9956a53df2

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.