MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 38cea6b8da276da415ba1f4127eb6db81f914e27335da458a540cd2db671886f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Dridex

Vendor detections: 8

Intelligence 8 IOCs YARA 2 File information Comments

SHA256 hash:	38cea6b8da276da415ba1f4127eb6db81f914e27335da458a540cd2db671886f
SHA3-384 hash:	609ea1e20bf5fa8b743048a9d7c33b0834bed67fd28c973b7429025858b53227be36089aab1c2eccacb0e38e0d318684
SHA1 hash:	6638bdaca6f07e1bcb607baffc5f7b524f8574c6
MD5 hash:	1ecc83ee713bc1a95b7342570cbfa129
humanhash:	tennis-uranus-lake-charlie
File name:	38cea6b8da276da415ba1f4127eb6db81f914e27335da458a540cd2db671886f
Download:	download sample
Signature	Dridex Create hunting rule
File size:	354'304 bytes
First seen:	2021-03-22 14:09:11 UTC
Last seen:	2021-03-22 15:35:27 UTC
File type:	dll
MIME type:	application/x-dosexec
imphash	23c9d8693c94ad7f203a8022ff01bde7 (5 x Dridex)
ssdeep	6144:0VAnyiEHDguikKTFVMzLLlwNri07g4yrJivTvEHWR:MAnyiediHWG1iH4MJiLvEH
TLSH	6774AF3160E18BD9D24399B788B4B6479FD4DCF0B0B895CBEBD7A46B43748D0363984A
Reporter	Cryptolaemus1
Tags:	10444 Dridex

Cryptolaemus1

Dridex 10444

Intelligence

File Origin

# of uploads :

# of downloads :

122

Origin country :

n/a

Vendor Threat Intelligence

Detection:

DridexLoader

Link:

https://www.capesandbox.com/analysis/125958/

Detection(s):

SecuriteInfo.com.Artemis1ECC83EE713B.14136.32176.UNOFFICIAL

Result

Verdict:

Clean

Maliciousness:

Behaviour

Sending a UDP request

Sending a custom TCP request

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/c5284a9c-4e75-45c2-8017-92b4a897778c

Result

Threat name:

Dridex

Detection:

malicious

Classification:

troj.evad

Score:

68 / 100

Link:

https://www.joesandbox.com/analysis/647925

Signature

C2 URLs / IPs found in malware configuration

Found malware configuration

System process connects to network (likely due to code injection or exploit)

Yara detected Dridex unpacked file

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/38cea6b8da276da415ba1f4127eb6db81f914e27335da458a540cd2db671886f/

Threat name:

Win32.Infostealer.Dridex

Status:

Malicious

First seen:

2021-03-22 14:10:10 UTC

AV detection:

12 of 29 (41.38%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=hdhknog2e5w2ifn2d5asp23nxapzctrhgno2iwffidgs3ntrrbxq._file

Result

Malware family:

dridex

Score:

10/10

Tags:

family:dridex botnet:10444 botnet discovery evasion loader trojan

Link:

https://tria.ge/reports/210322-jc8ttkkngx/

Behaviour

Suspicious use of WriteProcessMemory

Checks installed software on the system

Checks whether UAC is enabled

Blocklisted process makes network request

Dridex Loader

Dridex

Malware Config

C2 Extraction:

210.65.244.179:443
37.247.35.130:6601
103.18.108.116:6601

Unpacked files

SH256 hash:

bc475e4dd5ae5797e35e6bda82ad1ac9a10cdec349bfd86ec16963adfcc85ba1

MD5 hash:

b9504f75ef2b2f83ffe5d310943586a8

SHA1 hash:

edb0e96a873ad7cf55e695c0635750a96b233c79

Link:

https://www.unpac.me/results/b2ec728c-e36b-42f0-8fb3-812e3149eadd/

SH256 hash:

38cea6b8da276da415ba1f4127eb6db81f914e27335da458a540cd2db671886f

MD5 hash:

1ecc83ee713bc1a95b7342570cbfa129

SHA1 hash:

6638bdaca6f07e1bcb607baffc5f7b524f8574c6

Link:

https://www.unpac.me/results/b2ec728c-e36b-42f0-8fb3-812e3149eadd/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/38cea6b8da276da415ba1f4127eb6db81f914e27335da458a540cd2db671886f

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.