MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 110fe6f199298f89f704050eb4dc0d2b19b0985a74ead588441fabac693ab3f5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Dridex

Vendor detections: 5

Intelligence 5 IOCs YARA 1 File information Comments

SHA256 hash:	110fe6f199298f89f704050eb4dc0d2b19b0985a74ead588441fabac693ab3f5
SHA3-384 hash:	c3bc26a8bd75cdf6dd218bfa1dce63b8685d4c2cdc5a3f346ed5cbdc9832fcc79c500c4817758df0db83023e5db5ff17
SHA1 hash:	0549605be574665600cbbcd6cb7799eb21e08bd8
MD5 hash:	a3b9337cbcf2f32c9d3d507efcb729b7
humanhash:	salami-queen-oscar-floor
File name:	glex.exe
Download:	download sample
Signature	Dridex Create hunting rule
File size:	245'760 bytes
First seen:	2020-05-05 15:53:43 UTC
Last seen:	2020-05-05 16:46:12 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	3ff9d103d412b4aa1c3f46cf5b5df36b (2 x Dridex)
ssdeep	6144:dYd03W0iVRyzzn5rCr4R3zcWFycIrrwvfEXoS:C0GpefnxR3z7MrrwvfEY
Threatray	97 similar samples on MalwareBazaar
TLSH	FD34BDA067F99659F5F36F756DBA12855F76BCA2AC39C20C5340200E0DB6F849DA0B33
Reporter	abuse_ch
Tags:	Dridex GMX

abuse_ch

Dridex payload URL:
http://ginduq.com/glex.exe

Intelligence

File Origin

# of uploads :

# of downloads :

145

Origin country :

n/a

Vendor Threat Intelligence

Detection(s):

SecuriteInfo.com.FileRepMalware.18787.UNOFFICIAL

Gathering data

Threat name:

Win32.Trojan.Dridex

Status:

Malicious

First seen:

2020-05-05 16:48:09 UTC

File Type:

PE (Exe)

AV detection:

37 of 48 (77.08%)

Threat level:

2/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=ceh6n4mzfghyt5yeauhljxanfmm3bgc2otvnlcced6v2y2j2wp2q._file

Verdict:

malicious

Label(s):

dridex

Result

Malware family:

dridex

Score:

10/10

Tags:

family:dridex botnet loader evasion trojan

Link:

https://tria.ge/reports/201109-h5tj2h5qce/

Behaviour

Checks whether UAC is enabled

Dridex Loader

Dridex

Malware Config

C2 Extraction:

111.67.68.5:443
178.254.40.33:3389
172.86.183.147:691
107.161.25.120:8443

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.