MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b775a1f8663e7bdeef07cdd7497b91fa82dd7ab1015d138b2aeb8b51e77d3895. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Dridex

Vendor detections: 8

Intelligence 8 IOCs YARA 1 File information Comments

SHA256 hash:	b775a1f8663e7bdeef07cdd7497b91fa82dd7ab1015d138b2aeb8b51e77d3895
SHA3-384 hash:	ecf4353d84bd1de73a87fa15095ec9f91c578e3d72a1719fcb5c408479ee4bd7cbb23d095364c53f0512eb054343af19
SHA1 hash:	7427287604e93881e59bf3b7685a470ac589682e
MD5 hash:	bd1e5cf467316c24f4a99e4d904ed28e
humanhash:	iowa-papa-friend-connecticut
File name:	bd1e5cf467316c24f4a99e4d904ed28e.dll
Download:	download sample
Signature	Dridex Create hunting rule
File size:	484'352 bytes
First seen:	2020-10-07 12:21:01 UTC
Last seen:	2020-10-07 13:58:04 UTC
File type:	dll
MIME type:	application/x-dosexec
imphash	dda05b3c663889cd0c5699e7211aef6e (1 x Dridex)
ssdeep	12288:jSDeUvQ5cvZeHM4HL1VdzU9//p9EZxmTDZhCjaMgz5eRZ:jSaUpeHpHvm9//Pb7e
Threatray	16 similar samples on MalwareBazaar
TLSH	C1A4D0117992C172E0739A344875CBB60B7CBE500B244AEB63F8193E9E716C25E37DE9
Reporter	abuse_ch
Tags:	dll Dridex

Intelligence

File Origin

# of uploads :

# of downloads :

194

Origin country :

n/a

Vendor Threat Intelligence

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/68944/

Result

Verdict:

Malware

Maliciousness:

Behaviour

Sending a UDP request

Sending a custom TCP request

Result

Threat name:

Unknown

Detection:

malicious

Classification:

evad

Score:

60 / 100

Link:

https://www.joesandbox.com/analysis/484136

Signature

Machine Learning detection for sample

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

System process connects to network (likely due to code injection or exploit)

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/b775a1f8663e7bdeef07cdd7497b91fa82dd7ab1015d138b2aeb8b51e77d3895/

Threat name:

Win32.Infostealer.Dridex

Status:

Malicious

First seen:

2020-10-07 11:57:57 UTC

File Type:

PE (Dll)

AV detection:

21 of 29 (72.41%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=w522d6dghz5553yhzxlus64r7kbn26vraforhczk5ofvdz35hckq._file

Verdict:

malicious

Label(s):

dridex

Result

Malware family:

dridex

Score:

10/10

Tags:

botnet loader family:dridex evasion trojan discovery

Link:

https://tria.ge/reports/201007-3rwchzjftj/

Behaviour

Suspicious use of WriteProcessMemory

Checks installed software on the system

Checks whether UAC is enabled

Blacklisted process makes network request

Dridex Loader

Dridex

Malware Config

C2 Extraction:

177.87.70.3:443
213.133.102.195:3889
27.254.174.93:33443
27.254.174.77:4443

Unpacked files

SH256 hash:

b775a1f8663e7bdeef07cdd7497b91fa82dd7ab1015d138b2aeb8b51e77d3895

MD5 hash:

bd1e5cf467316c24f4a99e4d904ed28e

SHA1 hash:

7427287604e93881e59bf3b7685a470ac589682e

Link:

https://www.unpac.me/results/33196778-6016-469a-9bd1-cc6d368356a1/

SH256 hash:

30de1c8675e3ee52a791f69b73a771e1d4719acd97be5f4e960ed68cbec64713

MD5 hash:

265844fdee5c902c7d3eb343c2cd56e0

SHA1 hash:

eeba3dbb226ec833e457253a8d0227a6c566e8c3

Link:

https://www.unpac.me/results/33196778-6016-469a-9bd1-cc6d368356a1/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Trojan

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/b775a1f8663e7bdeef07cdd7497b91fa82dd7ab1015d138b2aeb8b51e77d3895

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.