MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8cf135b18385d551974bd154f551c480826168f358a3bf193af14ed514901411. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Dridex

Vendor detections: 8

Intelligence 8 IOCs YARA 2 File information Comments

SHA256 hash:	8cf135b18385d551974bd154f551c480826168f358a3bf193af14ed514901411
SHA3-384 hash:	1d869a2f876a2c45923b6dcee777e4e27302068e9ac5861805098b19503a8cac98c50d8b0310d2336611c150e8b92307
SHA1 hash:	da64df5d4d78f0de141924106df149d2c2b890ad
MD5 hash:	bde322c970c261758ef5378a8747625a
humanhash:	lithium-river-charlie-speaker
File name:	SecuriteInfo.com.Generic.mg.bde322c970c26175.31292
Download:	download sample
Signature	Dridex Create hunting rule
File size:	722'944 bytes
First seen:	2021-01-25 19:27:02 UTC
Last seen:	Never
File type:	dll
MIME type:	application/x-dosexec
imphash	50774a4f43fbf9643d746d83bfc877fd (13 x Dridex)
ssdeep	12288:xQHxo09/Q7zjtAB4dTtdI39QbOL07iP4Hys8Wx4P2cux7Y36SUdOtul:x8RRQ7+B4dZ697P4Hys8ucUzdOtu
Threatray	306 similar samples on MalwareBazaar
TLSH	1CF4E051BED0E479EB6E12344C2BECB6026ABC045B69FC9F31DE1E6F01A2252F417785
Reporter	SecuriteInfoCom
Tags:	Dridex

Intelligence

File Origin

# of uploads :

# of downloads :

158

Origin country :

n/a

Vendor Threat Intelligence

Detection:

DridexLoader

Link:

https://www.capesandbox.com/analysis/113780/

Detection(s):

SecuriteInfo.com.Generic.mg.bde322c970c26175.31292.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Sending a UDP request

Sending a custom TCP request

Result

Verdict:

UNKNOWN

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Result

Threat name:

Unknown

Detection:

malicious

Classification:

evad

Score:

60 / 100

Link:

https://www.joesandbox.com/analysis/589899

Signature

Found malware configuration

Machine Learning detection for sample

System process connects to network (likely due to code injection or exploit)

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/8cf135b18385d551974bd154f551c480826168f358a3bf193af14ed514901411/

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=rtytlmmdqxkvdf2l2fkpkuoeqcbgc2htlcr36gj26fhnkfeqcqiq._file

Verdict:

malicious

Label(s):

dridex

Result

Malware family:

dridex

Score:

10/10

Tags:

family:dridex botnet discovery evasion loader trojan

Link:

https://tria.ge/reports/210125-mev46frqls/

Behaviour

Suspicious use of WriteProcessMemory

Checks installed software on the system

Checks whether UAC is enabled

Blocklisted process makes network request

Dridex Loader

Dridex

Malware Config

C2 Extraction:

97.107.127.161:443
45.33.94.33:5037
159.89.91.92:5037
158.69.118.130:1443

Unpacked files

SH256 hash:

c05f759cb82794d3ed0b52bb0342e077a6adcf5a8943a7924a0ae980737be8c8

MD5 hash:

4a7c3b83af7bd14e70d834f1c84da9f1

SHA1 hash:

de24a30d9a43019b5915704a0c63fda550e6869f

Link:

https://www.unpac.me/results/76bb6763-4a02-4cfc-a7db-79f0f2222437/

SH256 hash:

8cf135b18385d551974bd154f551c480826168f358a3bf193af14ed514901411

MD5 hash:

bde322c970c261758ef5378a8747625a

SHA1 hash:

da64df5d4d78f0de141924106df149d2c2b890ad

Link:

https://www.unpac.me/results/76bb6763-4a02-4cfc-a7db-79f0f2222437/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/8cf135b18385d551974bd154f551c480826168f358a3bf193af14ed514901411

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.