MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2e165b1c349e44f6603305467a00c7ccf60ad65e87ccfbfcc1a1773e96057057. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Dridex

Vendor detections: 7

Intelligence 7 IOCs YARA 2 File information Comments

SHA256 hash:	2e165b1c349e44f6603305467a00c7ccf60ad65e87ccfbfcc1a1773e96057057
SHA3-384 hash:	78eed867f693d885b8453813a2b7c74ac303df5ef0c4a08c365f0f04d212582963a45c68f5581f79b3e7e4b23841cad2
SHA1 hash:	4103bca2d72a68ab0b573b7fb6fed0812a4ad503
MD5 hash:	473dd6d4287d65742adf94265492bcf1
humanhash:	island-idaho-east-nitrogen
File name:	2e165b1c349e44f6603305467a00c7ccf60ad65e87ccfbfcc1a1773e96057057
Download:	download sample
Signature	Dridex Create hunting rule
File size:	860'672 bytes
First seen:	2021-03-10 13:49:30 UTC
Last seen:	2021-03-10 15:56:54 UTC
File type:	dll
MIME type:	application/x-dosexec
imphash	527152ae4f410782dd90815c751a0c7b (6 x Dridex)
ssdeep	6144:1lCL0jB+qQPDS7Eg7BIoWzdk6N3QgqMjTm1m9/w4EuFBuqcVA+910kht:100jB+qqu7EhoQi6N3g1cRuqcVAO10W
TLSH	7605C4523A41F8A1F2282632CF21C5FC2B547C19DFB4596372E62F1F3AADDA795003A5
Reporter	Cryptolaemus1
Tags:	10444 Dridex

Cryptolaemus1

Dridex 10444

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Detection:

DridexLoader

Link:

https://www.capesandbox.com/analysis/123638/

Detection(s):

SecuriteInfo.com.ML.PE-A.11268.19345.UNOFFICIAL

Result

Verdict:

Clean

Maliciousness:

Behaviour

Sending a UDP request

Sending a custom TCP request

Result

Verdict:

UNKNOWN

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Gathering data

Threat name:

Win32.Trojan.Generic

Status:

Suspicious

First seen:

2021-03-10 13:50:08 UTC

AV detection:

7 of 28 (25.00%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=fylfwhbutzcpmybtavdhuaghzt3avvs6q7gpx7gbuf3t5fqfoblq._file

Result

Malware family:

dridex

Score:

10/10

Tags:

family:dridex botnet:10444 botnet loader

Link:

https://tria.ge/reports/210310-596haj717s/

Behaviour

Suspicious use of WriteProcessMemory

Dridex Loader

Dridex

Malware Config

C2 Extraction:

210.65.244.166:443
178.33.183.53:7443
157.7.139.198:6601

Unpacked files

SH256 hash:

22b84881f21e0b8c9d86a175e9da9eecf0b82be765a9c315acac7a456c035f2a

MD5 hash:

468ccdf1cbcd88ea71378154c5f8fdb6

SHA1 hash:

257b17402e57bdb7094826921c9417693374e2d6

Link:

https://www.unpac.me/results/3b79bdfb-c0e9-4a05-8028-693930ed7d6f/

SH256 hash:

2e165b1c349e44f6603305467a00c7ccf60ad65e87ccfbfcc1a1773e96057057

MD5 hash:

473dd6d4287d65742adf94265492bcf1

SHA1 hash:

4103bca2d72a68ab0b573b7fb6fed0812a4ad503

Link:

https://www.unpac.me/results/3b79bdfb-c0e9-4a05-8028-693930ed7d6f/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/2e165b1c349e44f6603305467a00c7ccf60ad65e87ccfbfcc1a1773e96057057

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.