MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 04aa3a1a3187d6945f82925ee45e97f043b9640653b2d653d966edb6f7326dc6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Dridex

Vendor detections: 6

Intelligence 6 IOCs YARA 3 File information Comments

SHA256 hash:	04aa3a1a3187d6945f82925ee45e97f043b9640653b2d653d966edb6f7326dc6
SHA3-384 hash:	d4689bfe270c92192a2a709601311586126b8bd4bf4680ce8ea6825cfb1c6e57760c42c41c7476d04e87f727c7d0c971
SHA1 hash:	f39aeff1eb6966b8277f14e08d394aca4bcd54bb
MD5 hash:	c476749198dd4a3bbbeeb1e9196b7854
humanhash:	lion-social-yankee-mike
File name:	u0zwbe4.zip
Download:	download sample
Signature	Dridex Create hunting rule
File size:	380'928 bytes
First seen:	2021-03-22 12:56:48 UTC
Last seen:	2021-03-22 15:10:58 UTC
File type:	dll
MIME type:	application/x-dosexec
imphash	1512c1dc11311e93f1ae8fdeceb34512 (6 x Dridex)
ssdeep	6144:F60UDiTddbN1Q+RN8AcQlTegBwNSpgD76XFEXY:fpT5E0KBYgD7OuI
TLSH	0784BF2160E1CBEAD10396778C6876479FE5ECF4647881C7BBDAE86F43788D03639846
Reporter	JAMESWT_WT
Tags:	dll Dridex

Intelligence

File Origin

# of uploads :

# of downloads :

130

Origin country :

n/a

Vendor Threat Intelligence

Detection:

DridexLoader

Link:

https://www.capesandbox.com/analysis/125925/

Detection(s):

SecuriteInfo.com.Program.Win32.Wacapew.Cml.4302.21716.UNOFFICIAL

Result

Verdict:

Clean

Maliciousness:

Behaviour

Sending a UDP request

Result

Verdict:

UNKNOWN

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Gathering data

Result

Threat name:

Unknown

Detection:

clean

Classification:

n/a

Score:

3 / 100

Link:

https://www.joesandbox.com/analysis/647792

Behaviour

Behavior Graph:

n/a

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/04aa3a1a3187d6945f82925ee45e97f043b9640653b2d653d966edb6f7326dc6/

Threat name:

Win32.Infostealer.Dridex

Status:

Malicious

First seen:

2021-03-22 12:57:09 UTC

File Type:

PE (Dll)

AV detection:

12 of 29 (41.38%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=asvdugrrq7ljix4csjpoixux6bb3szagkoznmu6zm3w3n5zsnxda._file

Result

Malware family:

dridex

Score:

10/10

Tags:

family:dridex botnet:10444 botnet discovery evasion loader trojan

Link:

https://tria.ge/reports/210322-xqv9e9wdpn/

Behaviour

Suspicious use of WriteProcessMemory

Checks installed software on the system

Checks whether UAC is enabled

Blocklisted process makes network request

Dridex Loader

Dridex

Malware Config

C2 Extraction:

210.65.244.179:443
37.247.35.130:6601
103.18.108.116:6601

Unpacked files

SH256 hash:

1c461eeb85efb030ccef4b77acc2dc86502900a3b29aa48b2f7c0c9d0f2a90fa

MD5 hash:

da6bdba08928b6165cb16c861073d1e0

SHA1 hash:

ec71f69fab995c51be8e3ebceb81dbd6b2e337ff

Link:

https://www.unpac.me/results/38b95cb5-ab36-4ccf-adb3-23ee481716bd/

SH256 hash:

04aa3a1a3187d6945f82925ee45e97f043b9640653b2d653d966edb6f7326dc6

MD5 hash:

c476749198dd4a3bbbeeb1e9196b7854

SHA1 hash:

f39aeff1eb6966b8277f14e08d394aca4bcd54bb

Link:

https://www.unpac.me/results/38b95cb5-ab36-4ccf-adb3-23ee481716bd/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/04aa3a1a3187d6945f82925ee45e97f043b9640653b2d653d966edb6f7326dc6

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.