MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 feada44e845212a5d52e3e05861e296b954b7ef52b916c92967cbc5baa4f2630. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Dridex

Vendor detections: 9

Intelligence 9 IOCs YARA 2 File information Comments

SHA256 hash:	feada44e845212a5d52e3e05861e296b954b7ef52b916c92967cbc5baa4f2630
SHA3-384 hash:	aebdcd5de68c37f9cae859b91c28d001ce2b867060a8aeca7eea539fc0a69d657ba1ef4f0649bc4c0dbb2fe79e933b9a
SHA1 hash:	6e36b0b3d1ea1228efb5f9b3689ee03ac5b467fd
MD5 hash:	b9ffcbc3f9472fd70785bcff60878e4d
humanhash:	table-bravo-bakerloo-zebra
File name:	SecuriteInfo.com.BScope.TrojanBanker.IcedID.13499
Download:	download sample
Signature	Dridex Create hunting rule
File size:	598'528 bytes
First seen:	2021-02-01 20:58:16 UTC
Last seen:	Never
File type:	dll
MIME type:	application/x-dosexec
imphash	28194db3cfb6f77342e517cb09a31de4 (17 x Dridex)
ssdeep	12288:p0cT1bQZlGjpuUi8VVS1J9eyio7jkYiNR0Xe:ackGUi0Tio7wYEee
Threatray	409 similar samples on MalwareBazaar
TLSH	DDD4D1B87540C0B4CC85443CF92CE6A8996DBDF78E14A10372FB7F2F3A3A991C55561A
Reporter	SecuriteInfoCom
Tags:	Dridex

Intelligence

File Origin

# of uploads :

# of downloads :

150

Origin country :

n/a

Vendor Threat Intelligence

Detection:

DridexLoader

Link:

https://www.capesandbox.com/analysis/115030/

Result

Verdict:

Malware

Maliciousness:

Behaviour

Sending a UDP request

Sending a custom TCP request

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Result

Threat name:

Unknown

Detection:

clean

Classification:

n/a

Score:

1 / 100

Link:

https://www.joesandbox.com/analysis/595937

Behaviour

Behavior Graph:

n/a

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/feada44e845212a5d52e3e05861e296b954b7ef52b916c92967cbc5baa4f2630/

Threat name:

Win32.Infostealer.Dridex

Status:

Malicious

First seen:

2021-02-01 17:51:29 UTC

AV detection:

13 of 29 (44.83%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=72w2ituekijklvjohycymhrjnokuw7xvfoiwzeuwps6fxkspeyya._file

Verdict:

malicious

Label(s):

dridex

Result

Malware family:

dridex

Score:

10/10

Tags:

family:dridex botnet:10444 botnet discovery evasion loader trojan

Link:

https://tria.ge/reports/210201-2epmchhwb2/

Behaviour

Suspicious use of WriteProcessMemory

Checks installed software on the system

Checks whether UAC is enabled

Blocklisted process makes network request

Dridex Loader

Dridex

Malware Config

C2 Extraction:

77.220.64.131:443
5.196.204.251:5037
192.99.41.136:981
24.229.3.146:4664

Unpacked files

SH256 hash:

448002da8bb5ab0946ff2e10710a6293d92c5011af1213fbc021ef15fa979dec

MD5 hash:

19feeb04858fe5f47125f5f636150737

SHA1 hash:

43f300d7b15ea7cfb79f617560fcb2ecebef8ed0

Link:

https://www.unpac.me/results/83802311-4825-47fd-a41d-5ce288ec7d9d/

SH256 hash:

feada44e845212a5d52e3e05861e296b954b7ef52b916c92967cbc5baa4f2630

MD5 hash:

b9ffcbc3f9472fd70785bcff60878e4d

SHA1 hash:

6e36b0b3d1ea1228efb5f9b3689ee03ac5b467fd

Link:

https://www.unpac.me/results/83802311-4825-47fd-a41d-5ce288ec7d9d/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

IcedID

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/feada44e845212a5d52e3e05861e296b954b7ef52b916c92967cbc5baa4f2630

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.