MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fd6f6c377f403f5faccf5c4bb03a0d5af94f7f57ac13572a42b187cdbda027cc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Dridex

Vendor detections: 5

Intelligence 5 IOCs YARA 1 File information Comments

SHA256 hash:	fd6f6c377f403f5faccf5c4bb03a0d5af94f7f57ac13572a42b187cdbda027cc
SHA3-384 hash:	7f076d16bf58dba85991776d1758c77c795ee66d5293c06917f0d43d6263a3e8722371bd8e6c7c32ee878726f6cc136d
SHA1 hash:	ff50e4396399178914c64653f33617a7c4f6df61
MD5 hash:	a19e9a48a5adb409f2eed82694231a7a
humanhash:	music-oven-helium-freddie
File name:	aejmelvv.dll
Download:	download sample
Signature	Dridex Create hunting rule
File size:	532'480 bytes
First seen:	2020-11-16 16:17:49 UTC
Last seen:	2020-11-17 13:24:43 UTC
File type:	dll
MIME type:	application/x-dosexec
imphash	d86c9caa2005654f598f605480e6a377 (1 x Dridex)
ssdeep	12288:57NJ+YF9o74mw1VMRx9FH1ugS0wJfCjM+u3c7:7IYF7Exb1x8U
Threatray	129 similar samples on MalwareBazaar
TLSH	14B45A113651802DF32F8F3C9857E5F42AD6BC62993539E736D91DABEF2724398A0342
Reporter	James_inthe_box
Tags:	dll Dridex

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Detection(s):

SecuriteInfo.com.generic.ml.8397.UNOFFICIAL

Result

Verdict:

Clean

Maliciousness:

Behaviour

Sending a UDP request

Result

Verdict:

UNKNOWN

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Result

Threat name:

Unknown

Detection:

malicious

Classification:

evad

Score:

64 / 100

Link:

https://www.joesandbox.com/analysis/538151

Signature

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

System process connects to network (likely due to code injection or exploit)

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/fd6f6c377f403f5faccf5c4bb03a0d5af94f7f57ac13572a42b187cdbda027cc/

Threat name:

Win32.Trojan.Generic

Status:

Suspicious

First seen:

2020-11-16 16:16:52 UTC

File Type:

PE (Dll)

Extracted files:

AV detection:

22 of 29 (75.86%)

Threat level:

5/5

Verdict:

malicious

Label(s):

dridex

Result

Malware family:

dridex

Score:

10/10

Tags:

family:dridex botnet discovery evasion loader trojan

Link:

https://tria.ge/reports/201116-4f24jker9j/

Behaviour

Suspicious use of WriteProcessMemory

Checks installed software on the system

Checks whether UAC is enabled

Blacklisted process makes network request

Dridex Loader

Dridex

Malware Config

C2 Extraction:

77.220.64.53:443
172.96.190.154:4664
209.126.111.137:33443
167.99.158.82:33443

Unpacked files

SH256 hash:

fd6f6c377f403f5faccf5c4bb03a0d5af94f7f57ac13572a42b187cdbda027cc

MD5 hash:

a19e9a48a5adb409f2eed82694231a7a

SHA1 hash:

ff50e4396399178914c64653f33617a7c4f6df61

Link:

https://www.unpac.me/results/1c6460c2-7d45-489a-9a27-918f4f46cbab/

SH256 hash:

fba2f1f50ea44202fe8318b1efdafdc5c94cf638eb0e5a20b2c61f4e8b1ac22b

MD5 hash:

85c04b830d3c6eaced2b098358107637

SHA1 hash:

1a9c5f4ab79c65dd68c79474dcf90d1baad987bc

Link:

https://www.unpac.me/results/1c6460c2-7d45-489a-9a27-918f4f46cbab/

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.