MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f36716c17a31aba286b9fd6eeb497aff8ed755e4310cec215c4ee123960c40d9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Dridex

Vendor detections: 7

Intelligence 7 IOCs YARA 2 File information Comments

SHA256 hash:	f36716c17a31aba286b9fd6eeb497aff8ed755e4310cec215c4ee123960c40d9
SHA3-384 hash:	d23a118c487e6e2176243aaa239084af013be8d7aba6ca62c2863098cfa4a5c58dd52ee72ab7d55eb15ae39e2f150a7f
SHA1 hash:	c07fbf393095463081de3fdabac5630f767cc306
MD5 hash:	ecf042ee8055a09c37a4345bd853cb30
humanhash:	alabama-minnesota-blue-stairway
File name:	f36716c17a31aba286b9fd6eeb497aff8ed755e4310cec215c4ee123960c40d9
Download:	download sample
Signature	Dridex Create hunting rule
File size:	860'672 bytes
First seen:	2021-03-10 13:44:26 UTC
Last seen:	2021-03-10 15:57:01 UTC
File type:	dll
MIME type:	application/x-dosexec
imphash	527152ae4f410782dd90815c751a0c7b (6 x Dridex)
ssdeep	6144:YlCL0jB+qQPDS7Eg7BIoWzdk6N3QgqMnTm1m9/w4EuFBuqcVA+910kh1:Y00jB+qqu7EhoQi6N3g1cRuqcVAO10W
Threatray	2 similar samples on MalwareBazaar
TLSH	4105C4523A41F8A1F2282632CF21C5FC2B547C19DFB4596372E62F1F3AADDA795003A5
Reporter	Cryptolaemus1
Tags:	10444 Dridex

Cryptolaemus1

Dridex 10444

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Detection:

DridexLoader

Link:

https://www.capesandbox.com/analysis/123631/

Detection(s):

SecuriteInfo.com.ML.PE-A.14756.23070.UNOFFICIAL

Result

Verdict:

Clean

Maliciousness:

Behaviour

Sending a UDP request

Result

Verdict:

UNKNOWN

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Gathering data

Threat name:

Win32.Trojan.Generic

Status:

Suspicious

First seen:

2021-03-10 13:45:07 UTC

File Type:

PE (Dll)

Extracted files:

AV detection:

15 of 27 (55.56%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=6ntrnql2ggv2fbvz7vxowsl276hnovpegegoyik4j3qshfqmidmq._file

Verdict:

unknown

Dridex

e49d4ca18c0950f98b1c4fb815a078e90441d11a6d38ff46a454363c5f79c9f2

Dridex

Result

Malware family:

dridex

Score:

10/10

Tags:

family:dridex botnet:10444 botnet loader

Link:

https://tria.ge/reports/210310-6ktsjqfepn/

Behaviour

Suspicious use of WriteProcessMemory

Dridex Loader

Dridex

Malware Config

C2 Extraction:

210.65.244.166:443
178.33.183.53:7443
157.7.139.198:6601

Unpacked files

SH256 hash:

e6b2c874619e7e89717690a5c673080f0c19d9b7ffb679c685c1371886259c17

MD5 hash:

89b86499e63a7cd29d4233830461f752

SHA1 hash:

faf81598f5c5134fe2b2897bc80669a5e10468aa

Link:

https://www.unpac.me/results/a412b078-1546-4eb8-8aa2-9878a01f9077/

SH256 hash:

f36716c17a31aba286b9fd6eeb497aff8ed755e4310cec215c4ee123960c40d9

MD5 hash:

ecf042ee8055a09c37a4345bd853cb30

SHA1 hash:

c07fbf393095463081de3fdabac5630f767cc306

Link:

https://www.unpac.me/results/a412b078-1546-4eb8-8aa2-9878a01f9077/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/f36716c17a31aba286b9fd6eeb497aff8ed755e4310cec215c4ee123960c40d9

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.