MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8a0258361b87a73111afc4fb6f2cf121aa3a52122577a3692628e577ab202a34. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Dridex

Vendor detections: 8

Intelligence 8 IOCs YARA 1 File information Comments

SHA256 hash:	8a0258361b87a73111afc4fb6f2cf121aa3a52122577a3692628e577ab202a34
SHA3-384 hash:	3ba4ff6d1a2d6682505e729fc22ff0650b8bad93d98ab65bbb6d6f804513ea583b81ea5d1ebe771bd7cc7a548b1c370b
SHA1 hash:	7e011fe7b0840a59931292fcccd4db27a859f835
MD5 hash:	29b3fb0c606603e980e207f9739eb36b
humanhash:	vermont-batman-fix-arkansas
File name:	29b3fb0c606603e980e207f9739eb36b.dll
Download:	download sample
Signature	Dridex Create hunting rule
File size:	483'328 bytes
First seen:	2020-10-08 17:51:36 UTC
Last seen:	Never
File type:	dll
MIME type:	application/x-dosexec
imphash	7249848e15e4dfe9c84af67a4d657c56 (1 x Dridex)
ssdeep	12288:MtlTbdpbZr/t7nmZKJMU6VZpP0YVLr6DsH26vkMleA08:Mtl1B/7nkT/PLiDMVeA
Threatray	22 similar samples on MalwareBazaar
TLSH	B2A4CF113A82C272E0B29A744475D7F6077CBD100B344EEB63F5197E8E34AD25A379EA
Reporter	abuse_ch
Tags:	dll Dridex

Intelligence

File Origin

# of uploads :

# of downloads :

206

Origin country :

n/a

Vendor Threat Intelligence

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/69341/

Result

Verdict:

Malware

Maliciousness:

Behaviour

Sending a UDP request

Result

Threat name:

Unknown

Detection:

malicious

Classification:

evad

Score:

60 / 100

Link:

https://www.joesandbox.com/analysis/485908

Signature

Machine Learning detection for sample

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

System process connects to network (likely due to code injection or exploit)

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/8a0258361b87a73111afc4fb6f2cf121aa3a52122577a3692628e577ab202a34/

Threat name:

Win32.Infostealer.Dridex

Status:

Malicious

First seen:

2020-10-08 17:53:05 UTC

AV detection:

18 of 29 (62.07%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=ribfqnq3q6ttcenpyt5w6lhregvduuqsev32g2jgfdsxpkzafi2a._file

Verdict:

malicious

Label(s):

dridex

Result

Malware family:

dridex

Score:

10/10

Tags:

botnet loader evasion trojan discovery family:dridex

Link:

https://tria.ge/reports/201008-965k4hzxca/

Behaviour

Suspicious use of WriteProcessMemory

Checks installed software on the system

Checks whether UAC is enabled

Blacklisted process makes network request

Dridex Loader

Dridex

Malware Config

C2 Extraction:

177.87.70.3:443
213.133.102.195:3889
27.254.174.93:33443
27.254.174.77:4443

Unpacked files

SH256 hash:

52ae37970d4586e58ba63fd83b441e5c4d527976b6f3bfa48e7b0f071b9b9593

MD5 hash:

fe716322e272608a57ab2329dbc28f85

SHA1 hash:

759ead65f44818332f9ff91b996b26a591ba4e6a

Link:

https://www.unpac.me/results/41bcb412-be42-4e85-9384-38eabbfe7b97/

SH256 hash:

8a0258361b87a73111afc4fb6f2cf121aa3a52122577a3692628e577ab202a34

MD5 hash:

29b3fb0c606603e980e207f9739eb36b

SHA1 hash:

7e011fe7b0840a59931292fcccd4db27a859f835

Link:

https://www.unpac.me/results/41bcb412-be42-4e85-9384-38eabbfe7b97/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/8a0258361b87a73111afc4fb6f2cf121aa3a52122577a3692628e577ab202a34

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.