MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 41a0e9ae19a114d1f5b7290cecd214b6d116a91867292bae6c3cf0b3597ee262. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Dridex

Vendor detections: 8

Intelligence 8 IOCs YARA 2 File information Comments

SHA256 hash:	41a0e9ae19a114d1f5b7290cecd214b6d116a91867292bae6c3cf0b3597ee262
SHA3-384 hash:	52180d711cc0570dacb0c8b556fd9fec1a871714581a3a508be8c76e770cda8c810a2fcac29fd157d7a084ecd7d44e0d
SHA1 hash:	1740ab533cfeaaaeef20e0940bdb7b01e52d9d48
MD5 hash:	4965ee15608d57ec31b181c3abd39aec
humanhash:	tennessee-xray-rugby-purple
File name:	41a0e9ae19a114d1f5b7290cecd214b6d116a91867292bae6c3cf0b3597ee262
Download:	download sample
Signature	Dridex Create hunting rule
File size:	592'896 bytes
First seen:	2021-03-29 19:10:31 UTC
Last seen:	2021-03-29 21:44:09 UTC
File type:	dll
MIME type:	application/x-dosexec
imphash	edc6948b5a0e28edf5415e634ea66606 (19 x Dridex)
ssdeep	12288:Bt+D1yz/1SXpqDaoWm8sFZHk3eBWIcCd:BcA1aLoBTQeBjcCd
Threatray	699 similar samples on MalwareBazaar
TLSH	11C4BF43A3E55421F6735F3808B349024BEFBDE28934C5A9A6C9214D2B2B7D44B7C79B
Reporter	Cryptolaemus1
Tags:	10444 Dridex

Cryptolaemus1

Dridex 10444

Intelligence

File Origin

# of uploads :

# of downloads :

141

Origin country :

n/a

Vendor Threat Intelligence

Detection:

DridexLoader

Link:

https://www.capesandbox.com/analysis/127794/

Detection(s):

SecuriteInfo.com.Trojan.Win32.Save.a.7264.25259.UNOFFICIAL

Result

Verdict:

Clean

Maliciousness:

Behaviour

Sending a UDP request

Sending a custom TCP request

Result

Verdict:

UNKNOWN

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/fe1ebe7e-c737-4a5c-9e4a-5249d72e2eee

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/41a0e9ae19a114d1f5b7290cecd214b6d116a91867292bae6c3cf0b3597ee262/

Threat name:

Win32.Worm.Cridex

Status:

Malicious

First seen:

2021-03-29 19:11:06 UTC

AV detection:

11 of 29 (37.93%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=igqotlqzueknd5nxfegozuquw3irnkiym4usxltmhtylgwl64jra._file

Verdict:

malicious

Label(s):

dridex

Result

Malware family:

dridex

Score:

10/10

Tags:

family:dridex botnet:10444 botnet loader

Link:

https://tria.ge/reports/210329-lgm7k5qkyj/

Behaviour

Suspicious use of WriteProcessMemory

Dridex Loader

Dridex

Malware Config

C2 Extraction:

210.65.244.176:443
37.34.58.210:6601
77.220.64.141:5037

Unpacked files

SH256 hash:

e1aa0f2a91ceeba4e41013358e433a058f95c953952e8c5ba9f481dba7da7b23

MD5 hash:

8275d9abb03f49e4aeed9349caccad0f

SHA1 hash:

32ca1159f3ba24272f6e78f7f49466682a11b9c1

Link:

https://www.unpac.me/results/c66f2fd2-205d-4cb2-9ef3-e0acb29ee18b/

SH256 hash:

41a0e9ae19a114d1f5b7290cecd214b6d116a91867292bae6c3cf0b3597ee262

MD5 hash:

4965ee15608d57ec31b181c3abd39aec

SHA1 hash:

1740ab533cfeaaaeef20e0940bdb7b01e52d9d48

Link:

https://www.unpac.me/results/c66f2fd2-205d-4cb2-9ef3-e0acb29ee18b/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/41a0e9ae19a114d1f5b7290cecd214b6d116a91867292bae6c3cf0b3597ee262

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.