MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0c197468076c14f7b6c4fd095009ff628970f2c8d408131f7afd306b5e65eedd. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Dridex

Vendor detections: 9

Intelligence 9 IOCs YARA 2 File information Comments

SHA256 hash:	0c197468076c14f7b6c4fd095009ff628970f2c8d408131f7afd306b5e65eedd
SHA3-384 hash:	0be27a7bcdc22a298e8bee117d9bd04112347ee0e48dd5bdba16b9b50e616d6d0317a9345fa26a0053e58b1bc6eb0450
SHA1 hash:	1b915218108640bf8f35f2a568cd510077cb5281
MD5 hash:	26795c6abcdf30533597b78a1afba293
humanhash:	maine-fanta-beer-steak
File name:	0c197468076c14f7b6c4fd095009ff628970f2c8d408131f7afd306b5e65eedd
Download:	download sample
Signature	Dridex Create hunting rule
File size:	576'000 bytes
First seen:	2021-03-30 22:34:03 UTC
Last seen:	2021-03-30 23:43:13 UTC
File type:	dll
MIME type:	application/x-dosexec
imphash	adeae1388ccab7d5ea2c08a636428844 (4 x Dridex)
ssdeep	12288:hbHAqgIuNsQBUXGlXA21Sp3vykrYIwtUfd+G+CkZ:pBCNrU2/CakrYIdZ+rZ
Threatray	721 similar samples on MalwareBazaar
TLSH	FCC4AE12A5629039F8B347B689FF594945AEBE90073464CB73C8996D5B7BAE03F30313
Reporter	Cryptolaemus1
Tags:	10444 Dridex

Cryptolaemus1

Dridex 10444

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/128802/

Detection(s):

SecuriteInfo.com.Trojan.Dridex.735.24952.9669.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Sending a UDP request

Sending a custom TCP request

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Gathering data

Threat name:

Win32.Worm.Cridex

Status:

Malicious

First seen:

2021-03-30 16:46:14 UTC

AV detection:

9 of 29 (31.03%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=bqmxi2ahnqkppnwe7uevacp7mkexb4wi2qebgh327uygwxtf53oq._file

Verdict:

malicious

Label(s):

dridex

Result

Malware family:

dridex

Score:

10/10

Tags:

family:dridex botnet:10444 botnet loader

Link:

https://tria.ge/reports/210330-dw83hts8qx/

Behaviour

Suspicious use of WriteProcessMemory

Dridex Loader

Dridex

Malware Config

C2 Extraction:

210.65.244.176:443
37.34.58.210:6601
77.220.64.141:5037

Unpacked files

SH256 hash:

41f735bfb50f57d7633bc43e1048ac1d75bceaa99647fdf4844372146d8c612a

MD5 hash:

0661fb0faf89202523c21cdbf0fcef2b

SHA1 hash:

091fc77976228733261368db325750d50db6365f

Link:

https://www.unpac.me/results/182e713d-7fd8-406a-a130-104b15111bac/

SH256 hash:

0c197468076c14f7b6c4fd095009ff628970f2c8d408131f7afd306b5e65eedd

MD5 hash:

26795c6abcdf30533597b78a1afba293

SHA1 hash:

1b915218108640bf8f35f2a568cd510077cb5281

Link:

https://www.unpac.me/results/182e713d-7fd8-406a-a130-104b15111bac/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/0c197468076c14f7b6c4fd095009ff628970f2c8d408131f7afd306b5e65eedd

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.