MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 222a5bb297c39893044751bd717eb369da1a421dc1650113dffa0c9564599da2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Dridex

Vendor detections: 9

Intelligence 9 IOCs YARA 2 File information Comments

SHA256 hash:	222a5bb297c39893044751bd717eb369da1a421dc1650113dffa0c9564599da2
SHA3-384 hash:	5cb103df5c50de4b3665772df928a82dc68cd78ae3735ef5ad20e6b48a582df950821f10e62766e35910164c86b78dba
SHA1 hash:	8d787d1276b1fde111ff41ec75241d367f747ce5
MD5 hash:	43c136e054c804d6d98d5bfcd5372ac5
humanhash:	sad-lion-cold-sad
File name:	222a5bb297c39893044751bd717eb369da1a421dc1650113dffa0c9564599da2
Download:	download sample
Signature	Dridex Create hunting rule
File size:	354'304 bytes
First seen:	2021-03-22 14:09:21 UTC
Last seen:	2021-03-22 15:35:33 UTC
File type:	dll
MIME type:	application/x-dosexec
imphash	23c9d8693c94ad7f203a8022ff01bde7 (5 x Dridex)
ssdeep	6144:UVAnyiEHDguikKTFVMzLLlwNri07g4yrJxvTvEkWQ:sAnyiediHWG1iH4MJxLvEk
TLSH	C574AF3160E18BD9D24399B788B4B6479FD4DCF0B0B895CBEBD7A46B43748D0363984A
Reporter	Cryptolaemus1
Tags:	10444 Dridex

Cryptolaemus1

Dridex 10444

Intelligence

File Origin

# of uploads :

# of downloads :

128

Origin country :

n/a

Vendor Threat Intelligence

Detection:

DridexLoader

Link:

https://www.capesandbox.com/analysis/125959/

Detection(s):

SecuriteInfo.com.Artemis43C136E054C8.175.1811.UNOFFICIAL

Result

Verdict:

Clean

Maliciousness:

Behaviour

Sending a UDP request

Sending a custom TCP request

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Dridex

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/870f6d2a-243b-48db-b0ad-0b95dee269c9

Result

Threat name:

Dridex

Detection:

malicious

Classification:

bank.troj.evad

Score:

76 / 100

Link:

https://www.joesandbox.com/analysis/647923

Signature

C2 URLs / IPs found in malware configuration

Detected Dridex e-Banking trojan

Found malware configuration

System process connects to network (likely due to code injection or exploit)

Yara detected Dridex unpacked file

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/222a5bb297c39893044751bd717eb369da1a421dc1650113dffa0c9564599da2/

Threat name:

Win32.Infostealer.Dridex

Status:

Malicious

First seen:

2021-03-22 14:10:10 UTC

AV detection:

11 of 29 (37.93%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=eivfxmuxyomjgbchkg6xc7vtnhnbuqq5yfsqce677igjkzcztwra._file

Result

Malware family:

dridex

Score:

10/10

Tags:

family:dridex botnet:10444 botnet discovery evasion loader trojan

Link:

https://tria.ge/reports/210322-l1xvr8hgyj/

Behaviour

Suspicious use of WriteProcessMemory

Checks installed software on the system

Checks whether UAC is enabled

Blocklisted process makes network request

Dridex Loader

Dridex

Malware Config

C2 Extraction:

210.65.244.179:443
37.247.35.130:6601
103.18.108.116:6601

Unpacked files

SH256 hash:

7486475bdcfd455464dcc237651cf463fe37baec526e308f2341e5e673c6eec3

MD5 hash:

8acbf8a684b4af9b9284103fe709d0be

SHA1 hash:

f2da946ee67e0db11824fb6e4f98d77ceb8f5afc

Link:

https://www.unpac.me/results/41d539f2-28d8-41ec-8a23-595937f5b37e/

SH256 hash:

222a5bb297c39893044751bd717eb369da1a421dc1650113dffa0c9564599da2

MD5 hash:

43c136e054c804d6d98d5bfcd5372ac5

SHA1 hash:

8d787d1276b1fde111ff41ec75241d367f747ce5

Link:

https://www.unpac.me/results/41d539f2-28d8-41ec-8a23-595937f5b37e/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/222a5bb297c39893044751bd717eb369da1a421dc1650113dffa0c9564599da2

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.