MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 45b2e2756067823fa368a662b7b8fad6e5b99a558ce1694a534bd38e1ef4287d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Dridex

Vendor detections: 7

Intelligence 7 IOCs YARA 1 File information Comments

SHA256 hash:	45b2e2756067823fa368a662b7b8fad6e5b99a558ce1694a534bd38e1ef4287d
SHA3-384 hash:	86b9a7aae59e99e1941a64b032656f9b9fef6cc1af3a56ae497bb8215c32e2ce303afabef0f4be07a12b93d85136c2d4
SHA1 hash:	8710ce4951df08ab490669229a1b0416494fe147
MD5 hash:	2e94ba2da1286e2b93005d46ee5fb6d7
humanhash:	ten-connecticut-texas-wyoming
File name:	2e94ba2da1286e2b93005d46ee5fb6d7.dll
Download:	download sample
Signature	Dridex Create hunting rule
File size:	1'279'488 bytes
First seen:	2020-11-09 19:24:44 UTC
Last seen:	2020-11-09 20:30:22 UTC
File type:	dll
MIME type:	application/x-dosexec
imphash	91f1271bf7e72793759fe22e4d9e083b (4 x Dridex)
ssdeep	24576:IjOXGq89BRVHd6njFrxNbesrP8AeXkyd/yis+eejq:dXT812njFrxNasrP8rXrsfejq
TLSH	3445E052F39A4461F233063588B7D5628B7D7F404A3C8DA731CA2C1F3D6B2B16A3975A
Reporter	abuse_ch
Tags:	dll Dridex

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Detection(s):

SecuriteInfo.com.Artemis.12332.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Sending a UDP request

Sending a custom TCP request

Result

Verdict:

UNKNOWN

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Result

Threat name:

Unknown

Detection:

malicious

Classification:

evad

Score:

64 / 100

Link:

https://www.joesandbox.com/analysis/527067

Signature

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

System process connects to network (likely due to code injection or exploit)

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/45b2e2756067823fa368a662b7b8fad6e5b99a558ce1694a534bd38e1ef4287d/

Threat name:

Win32.Infostealer.Dridex

Status:

Malicious

First seen:

2020-11-09 19:20:44 UTC

File Type:

PE (Dll)

AV detection:

23 of 29 (79.31%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=iwzoe5lam6bd7i3iuzrlpoh223s3tgsvrtqwssstjpjy4hxufb6q._file

Verdict:

unknown

Result

Malware family:

dridex

Score:

10/10

Tags:

family:dridex botnet discovery evasion loader trojan

Link:

https://tria.ge/reports/201109-lqjh1mq2s6/

Behaviour

Suspicious use of WriteProcessMemory

Checks installed software on the system

Checks whether UAC is enabled

Blacklisted process makes network request

Dridex Loader

Dridex

Malware Config

C2 Extraction:

94.126.8.2:443
37.187.161.206:33443
209.59.199.129:4443
157.245.130.146:3786

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/45b2e2756067823fa368a662b7b8fad6e5b99a558ce1694a534bd38e1ef4287d

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.