MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9789e808a4b2da31b349f133baafbfd9e05fc78b598915bb46c492c8aeef317f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Dridex

Vendor detections: 7

Intelligence 7 IOCs YARA 2 File information Comments

SHA256 hash:	9789e808a4b2da31b349f133baafbfd9e05fc78b598915bb46c492c8aeef317f
SHA3-384 hash:	8d47657ecf99215d5b3fa3438eda4e382b9881007ba8f88eceaff167319ed70b4f378369647a410804942a8c6a3e63f8
SHA1 hash:	2f01bbdbeddbe0f7a720b27d94dccf5f20dd5d32
MD5 hash:	c430c3f7ea936f4d4b40ca887d45bac2
humanhash:	alaska-football-mississippi-sweet
File name:	9789e808a4b2da31b349f133baafbfd9e05fc78b598915bb46c492c8aeef317f
Download:	download sample
Signature	Dridex Create hunting rule
File size:	638'464 bytes
First seen:	2021-03-01 18:21:47 UTC
Last seen:	2021-03-01 20:12:41 UTC
File type:	dll
MIME type:	application/x-dosexec
imphash	3c0860a13c678470735290ac333e3e38 (5 x Dridex)
ssdeep	6144:pLExaqvRuqh931pIwuZ0/GBzqiH859y1gH67QTy6zmBIUm/acyB0cht0dr3xyFSI:pLE0fqhtc05I1h6yi2IUHh/to3Wp
Threatray	495 similar samples on MalwareBazaar
TLSH	17D4382AF596C0A2D76851B49CA4FEFD8AC53C58CCA080537ED71F0F762E6139B6113A
Reporter	Cryptolaemus1
Tags:	10444 Dridex

Cryptolaemus1

Dridex 10444

Intelligence

File Origin

# of uploads :

# of downloads :

117

Origin country :

n/a

Vendor Threat Intelligence

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/120360/

Detection(s):

SecuriteInfo.com.generic.ml.20076.11078.UNOFFICIAL

Result

Verdict:

Clean

Maliciousness:

Behaviour

Sending a UDP request

Sending a custom TCP request

Result

Verdict:

UNKNOWN

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/9789e808a4b2da31b349f133baafbfd9e05fc78b598915bb46c492c8aeef317f/

Threat name:

Win32.Trojan.Malrep

Status:

Malicious

First seen:

2021-03-01 18:22:14 UTC

File Type:

PE (Dll)

Extracted files:

AV detection:

9 of 29 (31.03%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=s6e6qcfewlnddm2j6ez3vl573hqf7r4llgerlo2gysjmrlxpgf7q._file

Verdict:

malicious

Label(s):

dridex

gozi

Result

Malware family:

dridex

Score:

10/10

Tags:

family:dridex botnet:10444 botnet loader

Link:

https://tria.ge/reports/210301-6q1mdh8kg6/

Behaviour

Suspicious use of WriteProcessMemory

Dridex Loader

Dridex

Malware Config

C2 Extraction:

77.220.64.146:443
85.25.134.43:8172
213.208.134.178:6516

Unpacked files

SH256 hash:

379ab50a23ff38cf0b2e980b0b3b04bef93fdc95d1e0c99feb9e45334e1bc99e

MD5 hash:

d2a9e1e6cd2699d9b24b2d79d46d104d

SHA1 hash:

b99351ca3255c99ae7b74890d26d996757edac6f

Link:

https://www.unpac.me/results/11ce25e9-412b-46b8-8f5b-571b90440c43/

SH256 hash:

9789e808a4b2da31b349f133baafbfd9e05fc78b598915bb46c492c8aeef317f

MD5 hash:

c430c3f7ea936f4d4b40ca887d45bac2

SHA1 hash:

2f01bbdbeddbe0f7a720b27d94dccf5f20dd5d32

Link:

https://www.unpac.me/results/11ce25e9-412b-46b8-8f5b-571b90440c43/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/9789e808a4b2da31b349f133baafbfd9e05fc78b598915bb46c492c8aeef317f

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.