MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 03a4a28ccf750c1be52da2e87c729a26fe48c72007e03aba045ffd2a617c3a8e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Dridex

Vendor detections: 8

Intelligence 8 IOCs YARA 1 File information Comments

SHA256 hash:	03a4a28ccf750c1be52da2e87c729a26fe48c72007e03aba045ffd2a617c3a8e
SHA3-384 hash:	c2651845e9daa5e3310ed2f3eb7e021c1789404bfc64a94885fdba80a77b6dbbd0bff0c02b17ebfcad731e57627b53e2
SHA1 hash:	0cd33d5d35b7aadded71db83a38273abbc902a90
MD5 hash:	025dc58d72cfc2f41ffd21649ea2f374
humanhash:	ceiling-december-early-charlie
File name:	025dc58d72cfc2f41ffd21649ea2f374.dll
Download:	download sample
Signature	Dridex Create hunting rule
File size:	204'800 bytes
First seen:	2021-01-05 18:46:58 UTC
Last seen:	Never
File type:	dll
MIME type:	application/x-dosexec
imphash	a23873606d43d18aeb728673d0ce4249 (15 x Dridex, 1 x Gozi)
ssdeep	3072:JFsIcCVMdHhbwlilXv+/dw7NN24M/1Z/NHPp6Yyb5RmShVo2D:JF32hXYd6rrM9BNCNYS
Threatray	52 similar samples on MalwareBazaar
TLSH	39149E41ABB60119F5FA073139FE79640AB57C094934FF5E3342B1ABAE39BD088947B1
Reporter	abuse_ch
Tags:	dll Dridex

Intelligence

File Origin

# of uploads :

# of downloads :

261

Origin country :

n/a

Vendor Threat Intelligence

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/110607/

Detection(s):

Win.Malware.Generic-9809335-0

Result

Verdict:

Malware

Maliciousness:

Behaviour

Sending a UDP request

Result

Threat name:

Unknown

Detection:

clean

Classification:

n/a

Score:

2 / 100

Link:

https://www.joesandbox.com/analysis/574520

Behaviour

Behavior Graph:

n/a

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/03a4a28ccf750c1be52da2e87c729a26fe48c72007e03aba045ffd2a617c3a8e/

Threat name:

Win32.Trojan.Drixed

Status:

Malicious

First seen:

2021-01-05 18:47:04 UTC

AV detection:

25 of 29 (86.21%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=aoskfdgpougbxzjnuluhy4u2e37errzaa7qdvoqel76suyl4hkha._file

Verdict:

malicious

Label(s):

dridex

Result

Malware family:

dridex

Score:

10/10

Tags:

family:dridex botnet loader

Link:

https://tria.ge/reports/210105-tnlw7r9rq2/

Behaviour

Suspicious use of WriteProcessMemory

Dridex Loader

Dridex

Malware Config

C2 Extraction:

77.220.64.37:443
85.25.144.36:4643
51.15.176.55:3389
139.162.53.147:4443

Unpacked files

SH256 hash:

03a4a28ccf750c1be52da2e87c729a26fe48c72007e03aba045ffd2a617c3a8e

MD5 hash:

025dc58d72cfc2f41ffd21649ea2f374

SHA1 hash:

0cd33d5d35b7aadded71db83a38273abbc902a90

Link:

https://www.unpac.me/results/e234357d-b78f-4475-9a41-793e4b323065/

SH256 hash:

86fd3940e01d8ccb5c8550cfd84ed16210237e40de4ec2d22b1bd3011f3c0242

MD5 hash:

013f508d568c30e6306a012e9b0693b9

SHA1 hash:

d731155ab4344cd771a3f63320e168f0d568f809

Link:

https://www.unpac.me/results/e234357d-b78f-4475-9a41-793e4b323065/

SH256 hash:

786d3bac534c2ac628e64b7c691b63e1d216fa188e3a64afa1c0eb5c559db318

MD5 hash:

8f176b11a13202271b1a89240844441b

SHA1 hash:

0956bd680f64b343538760fd5a1a228d4ab8446f

Detections:

win_dridex_auto

Link:

https://www.unpac.me/results/e234357d-b78f-4475-9a41-793e4b323065/

Parent samples :

4d5f2df879408856825785fe3a63a6a119d7f617f4fc52243fc060d2708bf993
eb3154fc479e6ec838bffbf7cb1f4247c4286625e2311bf6ba50abf7a48044a1
786d3bac534c2ac628e64b7c691b63e1d216fa188e3a64afa1c0eb5c559db318
0c0a849067910325d3a8d5a6fc5ee0e24f418e6ea2e2ac0a91f93b6c81b25434
12b51b1bb3f57abdd5ddff5a2c86dd416d12669d85c1a999a419de5195e8f46d
119c6a4fbc1df623f74334c646cdd3444916427eacdb3d9222be9f758017492d
c0b724f92582625dc7bc44c89ce1fda666b52dbcec3c78228da762822fc58e49
330e60400c9e8c9ce5261540d31fb346d4a874eddee5040e465a03b368facb41
5188398a523a59bb95068adcfd096082f5ef204dbc572ee09fa09e2da2bc9dd9
0d271154fc1009f8f0034bbda517dc5f188a99100d6ef8a5827319b3ea30afff
25ca541958b7124f79002d471a96d08c3b6cd4b28320ebf344f0330169d80d9a
9723745ac74305a2b053a8b775bcf6f286786f8125af27752198a785877a2389
4280c27f9e3a0dae47929420089498fbef465f2daf892e7ddb04e1395c87cee4
99d8c0a7a6f68abe97bea4001cb14850de35ea9b0b35e2c40956b2f30595f378
9591987a6dcacd5edeeb4374628c09f8674bec41fa5beb0969bf2eeb10f7707c
041edba5ccd1c771382c57e623f3393248fd4c6cd86822a99061a571a531d1b9
03a4a28ccf750c1be52da2e87c729a26fe48c72007e03aba045ffd2a617c3a8e

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

0.80

Link:

https://yomi.yoroi.company/submissions/03a4a28ccf750c1be52da2e87c729a26fe48c72007e03aba045ffd2a617c3a8e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	win_dridex_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	autogenerated rule brought to you by yara-signator