MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f75b016f04df604ad70bbdb2c030c9a37e4597c36071c2f82229c88f1411d73f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Dridex

Vendor detections: 7

Intelligence 7 IOCs YARA 2 File information Comments

SHA256 hash:	f75b016f04df604ad70bbdb2c030c9a37e4597c36071c2f82229c88f1411d73f
SHA3-384 hash:	850648624d1f01e88eefb6e7d062c18586433d19cb3e47126912c98d049a05fcd8077427fc2d8b4114f888e781a8c5a0
SHA1 hash:	83278ba4321ebc65611b82d4b35e73008020f669
MD5 hash:	2df0b838e766fa6e91f516dbb0bd34ad
humanhash:	diet-floor-fillet-october
File name:	f75b016f04df604ad70bbdb2c030c9a37e4597c36071c2f82229c88f1411d73f
Download:	download sample
Signature	Dridex Create hunting rule
File size:	880'640 bytes
First seen:	2021-03-16 05:18:07 UTC
Last seen:	2021-03-16 06:49:15 UTC
File type:	dll
MIME type:	application/x-dosexec
imphash	8ce5cf6636b690adc707814c2493aa70 (4 x Dridex)
ssdeep	24576:sD/SO6D+/lmOOlMuR7hdMbVlo+MbLY+Om+Fmzk:sD/SBiAOOjtW3o+MbLSkQ
Threatray	538 similar samples on MalwareBazaar
TLSH	8915DF41B982EA78D40290B5DE8CCDFE094CFF45CE692A5370C97F9F73781A4623A529
Reporter	Cryptolaemus1
Tags:	10444 Dridex

Cryptolaemus1

Dridex 10444

Intelligence

File Origin

# of uploads :

# of downloads :

120

Origin country :

n/a

Vendor Threat Intelligence

Detection(s):

SecuriteInfo.com.Trojan.Win32.Save.a.27359.5430.UNOFFICIAL

Result

Verdict:

Clean

Maliciousness:

Behaviour

Sending a UDP request

Sending a custom TCP request

Result

Verdict:

UNKNOWN

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Dridex

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/8e62dbb0-2c66-4f1c-bb0b-7090b0723ed9

Result

Threat name:

Dridex

Detection:

malicious

Classification:

troj.evad

Score:

64 / 100

Link:

https://www.joesandbox.com/analysis/640291

Signature

C2 URLs / IPs found in malware configuration

Found malware configuration

Found potential dummy code loops (likely to delay analysis)

Yara detected Dridex unpacked file

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/f75b016f04df604ad70bbdb2c030c9a37e4597c36071c2f82229c88f1411d73f/

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=65nqc3ye35qevvylxwzmamgjun7elf6dmby4f6bcfhei6far247q._file

Verdict:

malicious

Label(s):

dridex

Result

Malware family:

dridex

Score:

10/10

Tags:

family:dridex botnet:10444 botnet discovery evasion loader trojan

Link:

https://tria.ge/reports/210316-phhnzyq16x/

Behaviour

Suspicious use of WriteProcessMemory

Checks installed software on the system

Checks whether UAC is enabled

Blocklisted process makes network request

Dridex Loader

Dridex

Malware Config

C2 Extraction:

210.65.244.184:443
147.78.186.4:10051
62.75.168.152:6601

Unpacked files

SH256 hash:

9d7fd92df57f904f3e42b13c89a9d77971653b324891f1035f70ca9670ed94df

MD5 hash:

a26eecc2679523bf9db67f2b8dc953e6

SHA1 hash:

2dd9eca0fb26a49a228f9fe77306ac9595afeab3

Link:

https://www.unpac.me/results/666bdb80-af46-42ed-b6a1-a890b129524e/

SH256 hash:

f75b016f04df604ad70bbdb2c030c9a37e4597c36071c2f82229c88f1411d73f

MD5 hash:

2df0b838e766fa6e91f516dbb0bd34ad

SHA1 hash:

83278ba4321ebc65611b82d4b35e73008020f669

Link:

https://www.unpac.me/results/666bdb80-af46-42ed-b6a1-a890b129524e/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/f75b016f04df604ad70bbdb2c030c9a37e4597c36071c2f82229c88f1411d73f

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.