MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ee264a9ac85435880323e9666bd673c0099fc8ffd3c6b5850291b98953d46169. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Dridex

Vendor detections: 7

Intelligence 7 IOCs YARA 2 File information Comments

SHA256 hash:	ee264a9ac85435880323e9666bd673c0099fc8ffd3c6b5850291b98953d46169
SHA3-384 hash:	48fd9c9889fa0a41f6653b25ae278936f7c1b70a2459c4d1c35cd24515ba41a8d578362a045f21e718b8d17f6d7cafab
SHA1 hash:	6a84185cb3c9dd38671d68ea6e2ed3548f72c7a6
MD5 hash:	3705a86b2b62f88d00f9cfb3c800bc06
humanhash:	echo-october-mars-connecticut
File name:	ee264a9ac85435880323e9666bd673c0099fc8ffd3c6b5850291b98953d46169
Download:	download sample
Signature	Dridex Create hunting rule
File size:	880'640 bytes
First seen:	2021-03-16 05:17:39 UTC
Last seen:	2021-03-16 06:49:14 UTC
File type:	dll
MIME type:	application/x-dosexec
imphash	8ce5cf6636b690adc707814c2493aa70 (4 x Dridex)
ssdeep	24576:BD/SO6D+/lmOOlMuR7hdMbVlo+MbLY+Om+Fmzx:BD/SBiAOOjtW3o+MbLSkF
Threatray	538 similar samples on MalwareBazaar
TLSH	2215DF41B982EA78D40290B5DE8CCDFE094CFF45CE692A5370C97F9F73781A4623A529
Reporter	Cryptolaemus1
Tags:	10444 Dridex

Cryptolaemus1

Dridex 10444

Intelligence

File Origin

# of uploads :

# of downloads :

119

Origin country :

n/a

Vendor Threat Intelligence

Detection(s):

SecuriteInfo.com.Trojan.Win32.Save.a.14517.6820.UNOFFICIAL

Result

Verdict:

Clean

Maliciousness:

Behaviour

Sending a UDP request

Sending a custom TCP request

Result

Verdict:

UNKNOWN

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Dridex

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/38cf7db6-7c31-4adb-aa5f-369233600ba8

Result

Threat name:

Dridex

Detection:

malicious

Classification:

troj.evad

Score:

64 / 100

Link:

https://www.joesandbox.com/analysis/640294

Signature

C2 URLs / IPs found in malware configuration

Found malware configuration

Found potential dummy code loops (likely to delay analysis)

Yara detected Dridex unpacked file

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/ee264a9ac85435880323e9666bd673c0099fc8ffd3c6b5850291b98953d46169/

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=5ytevgwikq2yqazd5ftgxvttyaez7sh72pdllbicsg4ysu6umfuq._file

Verdict:

malicious

Label(s):

dridex

Result

Malware family:

dridex

Score:

10/10

Tags:

family:dridex botnet:10444 botnet discovery evasion loader trojan

Link:

https://tria.ge/reports/210316-a53pdyw546/

Behaviour

Suspicious use of WriteProcessMemory

Checks installed software on the system

Checks whether UAC is enabled

Blocklisted process makes network request

Dridex Loader

Dridex

Malware Config

C2 Extraction:

210.65.244.184:443
147.78.186.4:10051
62.75.168.152:6601

Unpacked files

SH256 hash:

7e32a9852ba232ae2f11f68c68bef4d0bce3e3459db87180860301fe688c4469

MD5 hash:

1c3c350ac32543f327e94bdbd1a42c04

SHA1 hash:

55c5dc3101eaa6fc7d71e32306df6a01d636ffa3

Link:

https://www.unpac.me/results/4da1272e-e9c7-44f2-ac85-e701b6dbf6cb/

SH256 hash:

ee264a9ac85435880323e9666bd673c0099fc8ffd3c6b5850291b98953d46169

MD5 hash:

3705a86b2b62f88d00f9cfb3c800bc06

SHA1 hash:

6a84185cb3c9dd38671d68ea6e2ed3548f72c7a6

Link:

https://www.unpac.me/results/4da1272e-e9c7-44f2-ac85-e701b6dbf6cb/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/ee264a9ac85435880323e9666bd673c0099fc8ffd3c6b5850291b98953d46169

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.