MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1e553da2063c5773de05bd541cf8a3ec1bdd8d7153003b18b53f2a45c61df6c5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Dridex


Vendor detections: 10


Intelligence 10 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1e553da2063c5773de05bd541cf8a3ec1bdd8d7153003b18b53f2a45c61df6c5
SHA3-384 hash: 600342b9a0bd31959b2a3de9f582d52b3ca9f9a09ca9066f41b747d6bb1e6d5c4c2f5ac830c672efd7aca0b98bc06863
SHA1 hash: d9bd5b1ef320045a48a25100984dbf82cbb9f32e
MD5 hash: 66c742042aaa43ebef2a44953ac9fe45
humanhash: skylark-network-florida-august
File name:g38ufhf.zip.dll
Download: download sample
Signature Dridex
Create hunting rule
File size:368'640 bytes
First seen:2021-03-29 13:40:08 UTC
Last seen:2021-03-29 14:48:13 UTC
File type:DLL dll
MIME type:application/x-dosexec
imphash e7e490e0da58e39dbf299858321fb1e7 (4 x Dridex)
ssdeep 6144:BNcVrVDdp8+t1yTdawJZ1b9b7Q79nP+ymljFmbol3Wuh:ncVZdH1gxZHE7h/mjsb4h
Threatray 658 similar samples on MalwareBazaar
TLSH 0574D013B2E64432D2725B3808B7D6108AFF79D09AB4D4EB669D265C2B277C05B3C35B
Reporter James_inthe_box
Tags:dll Dridex

Intelligence

File Origin
# of uploads :
3
# of downloads :
109
Origin country :
n/a
Vendor Threat Intelligence
Detection:
DridexLoader
Create hunting rule
Link:
https://www.capesandbox.com/analysis/127599/
Detection(s):
SecuriteInfo.com.generic.ml.10131.19018.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
Sending a custom TCP request
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Dridex
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/304795b5-577e-4205-9f97-3b8558c19ac0
Result
Threat name:
Dridex
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
76 / 100
Link:
https://www.joesandbox.com/analysis/656957
Signature
C2 URLs / IPs found in malware configuration
Found malware configuration
Multi AV Scanner detection for submitted file
System process connects to network (likely due to code injection or exploit)
Yara detected Dridex unpacked file
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/1e553da2063c5773de05bd541cf8a3ec1bdd8d7153003b18b53f2a45c61df6c5/
Threat name:
Win32.Infostealer.Dridex
Create hunting rule
Status:
Malicious
First seen:
2021-03-29 13:39:56 UTC
File Type:
PE (Dll)
AV detection:
15 of 29 (51.72%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=dzkt3iqghrlxhxqfxvkbz6fd5qn53dlrkmadwgfvh4velrq563cq._file
Verdict:
malicious
Label(s):
dridex
Create hunting rule
gozi
Create hunting rule
Similar samples:
0b054f4923c36d9a313eb921268015b6b1ae298f5ab8adeb9902cf91c5fb2678
Dridex
3391f266ecea6f5fe101269bb944ab7a4d79be9f3d2da0823b839ca485ff984f
Dridex
48df40524456a981de9356a9b89ecfded629e931b85e9f8519effb9d4079379c
Dridex
9101c4df8358b9c115bb2cc874a4351d706040fd9c312e2acc045ff50f60006d
Dridex
96b51e628389b4044eb4c4d262deadbcfa778db13a7768ab7806b0e1f81d2ebf
Dridex
ac152e73957a8cb702eb7f18bb38e2bf92e4702e108ac71d403b829600b2029f
Dridex
b6ab389440b4a038ffde4ca381640a0bd982f8e970bcffdbe82629c0ae395ca7
Dridex
b6bd8479ef5943eaf26efdcda11ab09bf0569ad2295ba905fc0901511ca7c286
Dridex
d1fe195f615224b811ad982dcbcbc4551a4f9d3383e5a120a8f331b7d044d917
Dridex
dc003b3385ba8e86db0b5ce6a53a49ab03aebd59d5b46cf4a5312443c7c83c41
Dridex
+ 648 additional samples on MalwareBazaar
Result
Malware family:
dridex
Create hunting rule
Score:
  10/10
Tags:
family:dridex botnet:10444 botnet loader
Link:
https://tria.ge/reports/210329-rhmlgxpvss/
Behaviour
Suspicious use of WriteProcessMemory
Dridex Loader
Dridex
Malware Config
C2 Extraction:
210.65.244.176:443
37.34.58.210:6601
77.220.64.141:5037
Unpacked files
SH256 hash:
c98c8347e0afcb700f7c8e3dd9905eda37451fac785db2fb228a21baa8fd1003
MD5 hash:
080e03927659faf96a3ce7aad06c5c22
SHA1 hash:
392a54c3c5036a84c37768c10233df2e860e468f
Link:
https://www.unpac.me/results/6449a2db-33a3-4b0f-a360-595b59f9162a/
SH256 hash:
1e553da2063c5773de05bd541cf8a3ec1bdd8d7153003b18b53f2a45c61df6c5
MD5 hash:
66c742042aaa43ebef2a44953ac9fe45
SHA1 hash:
d9bd5b1ef320045a48a25100984dbf82cbb9f32e
Link:
https://www.unpac.me/results/6449a2db-33a3-4b0f-a360-595b59f9162a/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/1e553da2063c5773de05bd541cf8a3ec1bdd8d7153003b18b53f2a45c61df6c5

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DridexLoader
Create hunting rule
Author:kevoreilly
Description:Dridex v4 dropper C2 parsing function
Rule name:win_dridex_loader_v2
Create hunting rule
Author:Johannes Bader @viql
Description:detects some Dridex loaders

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other
Cape
Cape
https://www.capesandbox.com/analysis/127599/
  
URLhaus
https://urlhaus.abuse.ch/url/1098396/
  
URLhaus
https://urlhaus.abuse.ch/url/1098398/
  
URLhaus
https://urlhaus.abuse.ch/url/1098400/
  
URLhaus
https://urlhaus.abuse.ch/url/1098404/
  
URLhaus
https://urlhaus.abuse.ch/url/1098408/
  
URLhaus
https://urlhaus.abuse.ch/url/1098411/
  
URLhaus
https://urlhaus.abuse.ch/url/1098414/
  
URLhaus
https://urlhaus.abuse.ch/url/1098417/
  
URLhaus
https://urlhaus.abuse.ch/url/1098418/
  
URLhaus
https://urlhaus.abuse.ch/url/1098425/
  
URLhaus
https://urlhaus.abuse.ch/url/1098429/
  
URLhaus
https://urlhaus.abuse.ch/url/1098430/
  
URLhaus
https://urlhaus.abuse.ch/url/1098432/
  
URLhaus
https://urlhaus.abuse.ch/url/1098438/
  
URLhaus
https://urlhaus.abuse.ch/url/1098440/
  
URLhaus
https://urlhaus.abuse.ch/url/1098441/
  
URLhaus
https://urlhaus.abuse.ch/url/1098443/
  
URLhaus
https://urlhaus.abuse.ch/url/1098407/

Comments