🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3edf8fa45c0ae46229ba3fd68d3dbf05a00e1e3c49cb0d4d5005409b929570e2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Dridex


Vendor detections: 8


Intelligence 8 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3edf8fa45c0ae46229ba3fd68d3dbf05a00e1e3c49cb0d4d5005409b929570e2
SHA3-384 hash: fc559f8f5fde374af4d7d151dea0eee6b975aed62ac61a0899f725c558aba3436472ebc5062bbfb30a022e1a9dd3a422
SHA1 hash: a07af9dd5d6e71b057bc2dbdb2a70515d70125b4
MD5 hash: 327640941048c01dd6fd6d28d792cd48
humanhash: bravo-kentucky-foxtrot-bulldog
File name:327640941048c01dd6fd6d28d792cd48.dll
Download: download sample
Signature Dridex
Create hunting rule
File size:253'952 bytes
First seen:2021-02-11 08:00:18 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash 4627cd6003270b616a4b96f78cbc3f65 (5 x Dridex)
ssdeep 6144:aSaBi2ZFUOnhD8mc3oOpvXZ26u/6mv5gdC:aXRZHnhvfOpvXUx/6cgdC
Threatray 198 similar samples on MalwareBazaar
TLSH 1544AE80B287C19FC0620ABC363DE9FC226AFD504720D9353B66712B9D775D1582EBDA
Reporter abuse_ch
Tags:dll Dridex

Intelligence

File Origin
# of uploads :
1
# of downloads :
110
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/116693/
Detection(s):
SecuriteInfo.com.ArtemisTrojan.10098.UNOFFICIAL
Create hunting rule

Win.Malware.Bankerx-9829227-0
Create hunting rule

Win.Malware.Dridex-9829303-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
Result
Threat name:
Dridex
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
84 / 100
Link:
https://www.joesandbox.com/analysis/605459
Signature
C2 URLs / IPs found in malware configuration
Found malware configuration
Machine Learning detection for sample
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
System process connects to network (likely due to code injection or exploit)
Tries to detect sandboxes / dynamic malware analysis system (file name check)
Yara detected Dridex unpacked file
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/3edf8fa45c0ae46229ba3fd68d3dbf05a00e1e3c49cb0d4d5005409b929570e2/
Threat name:
Win32.Infostealer.Dridex
Create hunting rule
Status:
Malicious
First seen:
2021-02-11 14:48:38 UTC
AV detection:
25 of 29 (86.21%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=h3py7jc4blsgekn2h7li2pn7awqa4hr4jhfq2tkqavajxeuvodra._file
Verdict:
malicious
Label(s):
dridex
Create hunting rule
Similar samples:
05b9806f446c71ca46bbddc10176bf28838430bbecb9545cc730fdb93b205476
Dridex
1d5d1759d2c30ae4260bec6046d5cb2e5a74a98ca5f25e7c3ff68cc86b0d9eba
Dridex
296ffd7b9cd78965e7a97241b9fd2b54eaf77ecf0c7546f7fb7ef5e1f2761a4a
Dridex
3fde380555135b231bdff61f8ff4a28169e4df0c6b9eab4378cbf50160f3a235
Dridex
65b77f03c8dcc095dc51d0bd3a273a94b0c616187440f2fcdd2c3e9da1f7e787
Dridex
af142f2603ede1233e733fdcb3cf44d63f1d3cf57f462dcfb27c14975a635993
Dridex
d0cb82a9f20bb544184fb26f843022774bc9d286c65fbc3ccb839f480d573573
Dridex
e8895c6342f316a7523ff822c7087ba3a765ab9ef9edd489f9a072740cb743a0
Dridex
f62e65a5b9edfeef3217d3e131f8eb63aac24cfdc325f50a4bcdcbb18236196a
Dridex
fdf50dbb288d2bd4a325783e72c1e5c598c87ed11725131f14f449dd6cc22cb1
Dridex
+ 188 additional samples on MalwareBazaar
Result
Malware family:
dridex
Create hunting rule
Score:
  10/10
Tags:
family:dridex botnet:111 botnet discovery evasion loader trojan
Link:
https://tria.ge/reports/210211-l3np7zstfj/
Behaviour
Suspicious use of WriteProcessMemory
Checks installed software on the system
Checks whether UAC is enabled
Blocklisted process makes network request
Dridex Loader
Dridex
Malware Config
C2 Extraction:
77.220.64.149:443
80.11.32.115:4646
77.81.247.140:5037
Unpacked files
SH256 hash:
f754ef2c17935c79e523ffaef8048beec4b8ad6a510b1d37dd6a6c5b6467fdcd
MD5 hash:
961e5952e5a74cb20949eb3ad986e933
SHA1 hash:
ac3261e77a7a77429849edadbf10a102f6aaa03f
Link:
https://www.unpac.me/results/ac887f72-99d6-485b-8cf5-ba64dbc01a54/
SH256 hash:
4e0383d6e5201b1b09d9d7f77a558ad3edba9b95503de3422ad162b887404043
MD5 hash:
86774971e50d0db45d0818c10b8bed1b
SHA1 hash:
a07d9c5b6d3e2e5b772e6d056aad9c46168441d3
Link:
https://www.unpac.me/results/ac887f72-99d6-485b-8cf5-ba64dbc01a54/
SH256 hash:
3edf8fa45c0ae46229ba3fd68d3dbf05a00e1e3c49cb0d4d5005409b929570e2
MD5 hash:
327640941048c01dd6fd6d28d792cd48
SHA1 hash:
a07af9dd5d6e71b057bc2dbdb2a70515d70125b4
Link:
https://www.unpac.me/results/ac887f72-99d6-485b-8cf5-ba64dbc01a54/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/3edf8fa45c0ae46229ba3fd68d3dbf05a00e1e3c49cb0d4d5005409b929570e2

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Keylog_bin_mem
Create hunting rule
Author:James_inthe_box
Description:Contains Keylog
Rule name:MALWARE_Win_DLLLoader
Create hunting rule
Author:ditekSHen
Description:Detects unknown DLL Loader

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Dridex

DLL dll 3edf8fa45c0ae46229ba3fd68d3dbf05a00e1e3c49cb0d4d5005409b929570e2

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/999415/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/116693/

Comments