MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9cb1b69df5dc3367328b81e3ee833363396ee8fbf237cf14aef4db6385a0b4f4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Dridex

Vendor detections: 7

Intelligence 7 IOCs YARA 2 File information Comments

SHA256 hash:	9cb1b69df5dc3367328b81e3ee833363396ee8fbf237cf14aef4db6385a0b4f4
SHA3-384 hash:	4d2a3cac6858f24b4e6b982dda6e44c037759b1f65452013bcba9ccdccb05c79962a17a96a59061a0b55381642e1b11e
SHA1 hash:	0d4555771c6b68e9b8d31a913ff93f1c6a46d53f
MD5 hash:	8b127644222cc35824d61449517f9ccb
humanhash:	lithium-undress-harry-may
File name:	9cb1b69df5dc3367328b81e3ee833363396ee8fbf237cf14aef4db6385a0b4f4
Download:	download sample
Signature	Dridex Create hunting rule
File size:	516'096 bytes
First seen:	2021-03-11 06:11:46 UTC
Last seen:	2021-03-11 07:59:47 UTC
File type:	dll
MIME type:	application/x-dosexec
imphash	72fcf4d1ef6b7a492cf6b81aff237b75 (5 x Dridex)
ssdeep	6144:E5zvQsMoIlA3Yj5RuhIUSFiqdLJCnkBQfpkM3nCoP3L7B:0HMoIMYaqBFDdL4k+pkM33Pb
Threatray	1'324 similar samples on MalwareBazaar
TLSH	C6B4E5513A40F9B1E66816B6CF21D5FC27907C28CFB0656375E62F4F3AAE9A385D0390
Reporter	Cryptolaemus1
Tags:	10444 Dridex

Cryptolaemus1

Dridex 10444

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Detection:

DridexLoader

Link:

https://www.capesandbox.com/analysis/123683/

Detection(s):

SecuriteInfo.com.Trojan.Win32.Save.a.27308.27414.UNOFFICIAL

Result

Verdict:

Clean

Maliciousness:

Behaviour

Sending a UDP request

Sending a custom TCP request

Result

Verdict:

UNKNOWN

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/9cb1b69df5dc3367328b81e3ee833363396ee8fbf237cf14aef4db6385a0b4f4/

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=tsy3nhpv3qzwomulqhr65aztmm4w52h36i346ffo6tnwhbnawt2a._file

Verdict:

malicious

Label(s):

dridex

Result

Malware family:

dridex

Score:

10/10

Tags:

family:dridex botnet:10444 botnet discovery evasion loader trojan

Link:

https://tria.ge/reports/210311-wpeh5l6q42/

Behaviour

Suspicious use of WriteProcessMemory

Checks installed software on the system

Checks whether UAC is enabled

Blocklisted process makes network request

Dridex Loader

Dridex

Malware Config

C2 Extraction:

210.65.244.166:443
178.33.183.53:7443
157.7.139.198:6601

Unpacked files

SH256 hash:

2723bbe65e8edf8adb18bde0c9dd73dc188b779fc4ab5af923e875ba2d58b2c7

MD5 hash:

c1a83653095ffcb86866b96a5e0f14b5

SHA1 hash:

d95acf6226b621fc6fa0a1f4b023a43ce75c12f3

Link:

https://www.unpac.me/results/a279a5c1-1a1b-48fb-89df-5eadc9531671/

SH256 hash:

9cb1b69df5dc3367328b81e3ee833363396ee8fbf237cf14aef4db6385a0b4f4

MD5 hash:

8b127644222cc35824d61449517f9ccb

SHA1 hash:

0d4555771c6b68e9b8d31a913ff93f1c6a46d53f

Link:

https://www.unpac.me/results/a279a5c1-1a1b-48fb-89df-5eadc9531671/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Trojan

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/9cb1b69df5dc3367328b81e3ee833363396ee8fbf237cf14aef4db6385a0b4f4

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.