MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0d670427e1db3824d0d0e3dce77a4bbc682ea85f9196c5b2fe3928372d6ea43c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Dridex


Vendor detections: 10


Intelligence 10 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0d670427e1db3824d0d0e3dce77a4bbc682ea85f9196c5b2fe3928372d6ea43c
SHA3-384 hash: 6524ce9b44315e6511b2e69089cbdc3365dfa4ce28f207c5b9413ed7d17ed8f39b72f4c3a0819d5de694cc44fb062b34
SHA1 hash: 7e8b0b949f5d34c74f31e26debfcc96857e3215e
MD5 hash: 4fab5c8d626c505426b374f780a9ad7c
humanhash: kansas-golf-september-alaska
File name:4fab5c8d626c505426b374f780a9ad7c.dll
Download: download sample
Signature Dridex
Create hunting rule
File size:576'000 bytes
First seen:2021-02-01 18:10:31 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash 9f155d069630db0dd20e2b708dcbe65f (9 x Dridex)
ssdeep 6144:DV9y7D5S9oY/fWpJwpcroS7G4F735egYHknym3l/ooV+bLUATfFezFbaYMzseSR2:e2fkRG4535RxJl/ovfUdFJMQh1W16d
Threatray 393 similar samples on MalwareBazaar
TLSH C9C4D1B9794041A5CC41543CF43CF6A888AE7CB78E14A15372FF3E1F7B3A9A2C515A1A
Reporter abuse_ch
Tags:dll Dridex

Intelligence

File Origin
# of uploads :
1
# of downloads :
163
Origin country :
n/a
Vendor Threat Intelligence
Detection:
DridexLoader
Create hunting rule
Link:
https://www.capesandbox.com/analysis/114996/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
Sending a custom TCP request
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Unknown
Detection:
malicious
Classification:
n/a
Score:
60 / 100
Link:
https://www.joesandbox.com/analysis/595717
Signature
Found malware configuration
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0d670427e1db3824d0d0e3dce77a4bbc682ea85f9196c5b2fe3928372d6ea43c/
Threat name:
Win32.Infostealer.Dridex
Create hunting rule
Status:
Malicious
First seen:
2021-02-01 18:11:05 UTC
AV detection:
9 of 46 (19.57%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=bvtqij7b3m4cjugq4pooo6slxruc5kc7sglmlmx6heudollouq6a._file
Verdict:
malicious
Label(s):
dridex
Create hunting rule
Similar samples:
255995667a9a05831875a40be90deb7249afc94628b9a1676d9c4b859968b3f9
Dridex
3a4bd219435b2324b3976dbb7b90789aa4a5cb17567bc6a7129d1e73bfaaa413
Dridex
4474c2ccab521311c533fb7c3088da9be624fc16474c2765eec2f4941a2e8557
Dridex
4b2a101f9e7e0119409b6faae798c1e9fada080f055509f477c598365e1f6618
Dridex
4cbf096f538dc6c0230f43e5258daf31e226fd7f2830cb6073065ad751fadf6f
Dridex
5b8103401915c9021edb2687659361e8747fc9151b69b6389827f57644cfde3c
Dridex
83c390d82e19beec14d007b7350f4296c23ce9b3d131a3670ebb7424ad917410
Dridex
8b1203e7ff8ead64a388e8000955871b931202a9fd56ba339de65b01628fff6b
Dridex
d79d8b1f8c2b068663c2dbecb542ec0f8912a422947b93077c8619702f130b9f
Dridex
dd6039f57c72056748007b0dd5070aa7deac990972d33e8a9d5118122e559590
Dridex
+ 383 additional samples on MalwareBazaar
Result
Malware family:
dridex
Create hunting rule
Score:
  10/10
Tags:
family:dridex botnet:10444 botnet discovery evasion loader trojan
Link:
https://tria.ge/reports/210201-lf6dj78nra/
Behaviour
Suspicious use of WriteProcessMemory
Checks installed software on the system
Checks whether UAC is enabled
Blocklisted process makes network request
Dridex Loader
Dridex
Malware Config
C2 Extraction:
77.220.64.131:443
5.196.204.251:5037
192.99.41.136:981
24.229.3.146:4664
Unpacked files
SH256 hash:
59f52ab1e742765682639d277cd4c2de0242ae82e5d4f650d3a2ee3d5652fb0f
MD5 hash:
1fcdf79bf7cfd8fc381973c1f6547eed
SHA1 hash:
4492a67112f954a21be11734e699d5fd3185327f
Link:
https://www.unpac.me/results/7abba144-5db3-415e-8425-33933be4be25/
SH256 hash:
0d670427e1db3824d0d0e3dce77a4bbc682ea85f9196c5b2fe3928372d6ea43c
MD5 hash:
4fab5c8d626c505426b374f780a9ad7c
SHA1 hash:
7e8b0b949f5d34c74f31e26debfcc96857e3215e
Link:
https://www.unpac.me/results/7abba144-5db3-415e-8425-33933be4be25/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/0d670427e1db3824d0d0e3dce77a4bbc682ea85f9196c5b2fe3928372d6ea43c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DridexLoader
Create hunting rule
Author:kevoreilly
Description:Dridex v4 dropper C2 parsing function
Rule name:win_dridex_loader_v2
Create hunting rule
Author:Johannes Bader @viql
Description:detects some Dridex loaders

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Dridex

DLL dll 0d670427e1db3824d0d0e3dce77a4bbc682ea85f9196c5b2fe3928372d6ea43c

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/986256/
  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/986267/
  
URLhaus
https://urlhaus.abuse.ch/url/986303/
Cape
Cape
https://www.capesandbox.com/analysis/114996/

Comments