MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1e7cff422cd9fda456283527e027500af16f9ceceeb23467d55839286b14a8ea. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Dridex

Vendor detections: 12

Intelligence 12 IOCs YARA 3 File information Comments

SHA256 hash:	1e7cff422cd9fda456283527e027500af16f9ceceeb23467d55839286b14a8ea
SHA3-384 hash:	149ec21d970647de662c783e63562b1982908b1fc258e6090ebdfa8f21a73c393c3ef878bb9aa157d9f4cb58ca41bb4a
SHA1 hash:	d8877cfd0fa7a9d4c5fff74145f4d254d3085094
MD5 hash:	878e2c1c10548a5abbc85cc1334c3aa4
humanhash:	kitten-washington-triple-october
File name:	878e2c1c10548a5abbc85cc1334c3aa4
Download:	download sample
Signature	Dridex Create hunting rule
File size:	167'936 bytes
First seen:	2021-07-14 20:34:50 UTC
Last seen:	2021-07-15 11:58:02 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	e92132005097daafddd51d9c4d138d88 (6 x Dridex)
ssdeep	3072:V7p3dQo86PI7e2seimPWy6Ox1uTQjY48+STfLbh9w47sIs:f3dyj7NsedkOx1KQU5TTbbT
Threatray	4'585 similar samples on MalwareBazaar
TLSH	T139F302D1B39A11FEFD1D6470960BA9A612A70D29C37CCAE7E110DC917DE48F7243512A
Reporter	zbetcheckin
Tags:	32 Dridex exe

Intelligence

File Origin

# of uploads :

# of downloads :

135

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

878e2c1c10548a5abbc85cc1334c3aa4

Verdict:

Suspicious activity

Analysis date:

2021-07-14 20:39:21 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/bb2d686f-87eb-438c-b98f-b92224e5b46f

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

DridexLoader

Link:

https://www.capesandbox.com/analysis/171817/

Detection(s):

SecuriteInfo.com.Trojan.Dridex.776.23142.1300.UNOFFICIAL

Result

Verdict:

UNKNOWN

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Dridex

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/ae14f16c-36e5-46ac-bee1-0de0d84466bd

Result

Threat name:

Dridex Dropper

Detection:

malicious

Classification:

bank.troj.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/816571

Signature

C2 URLs / IPs found in malware configuration

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Dridex dropper found

Found malware configuration

Found potential dummy code loops (likely to delay analysis)

Machine Learning detection for sample

Multi AV Scanner detection for submitted file

Tries to delay execution (extensive OutputDebugStringW loop)

Tries to detect sandboxes / dynamic malware analysis system (file name check)

Tries to detect virtualization through RDTSC time measurements

Yara detected Dridex unpacked file

Behaviour

Behavior Graph:

Download SVG

Detection:

dridex

Link:

https://mwdb.cert.pl/sample/1e7cff422cd9fda456283527e027500af16f9ceceeb23467d55839286b14a8ea/

Threat name:

Win32.Trojan.Emotet

Status:

Malicious

First seen:

2021-07-14 17:30:39 UTC

File Type:

PE (Exe)

AV detection:

25 of 46 (54.35%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=dz6p6qrm3h62ivrigut6aj2qblyw7hhm52zdiz6vla4sq2yuvdva._file

Verdict:

malicious

Label(s):

doppeldridex

dridex

Result

Malware family:

dridex

Score:

10/10

Tags:

family:dridex botnet:22201 botnet evasion loader trojan

Link:

https://tria.ge/reports/210714-1knv7mvvqx/

Behaviour

Checks whether UAC is enabled

Dridex Loader

Dridex

Malware Config

C2 Extraction:

202.29.60.34:443
66.175.217.172:13786
78.46.78.42:9043

Unpacked files

SH256 hash:

a009231435f26f263ac7834efd724bbd1d4a548a7c754c4a73780f789d9367d6

MD5 hash:

9234b1284a30c74f7836f2f7d2a084e9

SHA1 hash:

4a50590dcb2a0cb1b7374df68b611e29bdff283c

Detections:

win_doppeldridex_auto

Link:

https://www.unpac.me/results/3e1a2135-2497-4e9b-bb5d-4ce14299c950/

SH256 hash:

1e7cff422cd9fda456283527e027500af16f9ceceeb23467d55839286b14a8ea

MD5 hash:

878e2c1c10548a5abbc85cc1334c3aa4

SHA1 hash:

d8877cfd0fa7a9d4c5fff74145f4d254d3085094

Link:

https://www.unpac.me/results/3e1a2135-2497-4e9b-bb5d-4ce14299c950/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

0.96

Link:

https://yomi.yoroi.company/submissions/1e7cff422cd9fda456283527e027500af16f9ceceeb23467d55839286b14a8ea

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	DridexLoader Create hunting rule
Author:	kevoreilly
Description:	Dridex v4 dropper C2 parsing function

Rule name:	INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFuture Create hunting rule
Author:	ditekSHen
Description:	Detect executables with stomped PE compilation timestamp that is greater than local current time