MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4600e7951a48232623a4c9eaae2209d2a56e6d174d9a5da837fcc4be143f67fa. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Dridex

Vendor detections: 10

Intelligence 10 IOCs YARA 2 File information Comments

SHA256 hash:	4600e7951a48232623a4c9eaae2209d2a56e6d174d9a5da837fcc4be143f67fa
SHA3-384 hash:	b65746bd9bb2b3aeed1b2c6d728c0e2aa0e795f8b79abecce42d6696289ba390b9248d1e62030e6fcdf84deb5e077e32
SHA1 hash:	dab99e5990cab0c9eb2cabd7fef6bd489d53bbd4
MD5 hash:	a3cdbeb1d41c114bee6784c02ca42cd6
humanhash:	india-whiskey-moon-april
File name:	a3cdbeb1d41c114bee6784c02ca42cd6
Download:	download sample
Signature	Dridex Create hunting rule
File size:	167'936 bytes
First seen:	2021-07-14 20:34:58 UTC
Last seen:	2021-07-14 21:49:03 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	e92132005097daafddd51d9c4d138d88 (6 x Dridex)
ssdeep	3072:77p3dQo86PI7e2seiSPWP6Ox1uTQjY48+STfLbh9w47sIB:Z3dyj7NsellOx1KQU5TTbbT
Threatray	4'584 similar samples on MalwareBazaar
TLSH	T12CF302D1B39A11FEFD5D6470960BAAA612A70C29C37CCAE7E110DC917DE48FB243512A
Reporter	zbetcheckin
Tags:	32 Dridex exe

Intelligence

File Origin

# of uploads :

# of downloads :

138

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

a3cdbeb1d41c114bee6784c02ca42cd6

Verdict:

Suspicious activity

Analysis date:

2021-07-14 20:39:21 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/3bd5a4da-4b1a-45bc-9337-414ffcf4dca3

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/171818/

Detection(s):

SecuriteInfo.com.Trojan.Dridex.776.5514.8300.UNOFFICIAL

Result

Verdict:

UNKNOWN

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Dridex

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/c56a734b-27e8-4e9c-a6a8-2b580059a35d

Result

Threat name:

Dridex Dropper

Detection:

malicious

Classification:

bank.troj.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/816570

Signature

C2 URLs / IPs found in malware configuration

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Dridex dropper found

Found malware configuration

Found potential dummy code loops (likely to delay analysis)

Machine Learning detection for sample

Multi AV Scanner detection for submitted file

Tries to delay execution (extensive OutputDebugStringW loop)

Tries to detect sandboxes / dynamic malware analysis system (file name check)

Tries to detect virtualization through RDTSC time measurements

Yara detected Dridex unpacked file

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/4600e7951a48232623a4c9eaae2209d2a56e6d174d9a5da837fcc4be143f67fa/

Threat name:

Win32.Trojan.Wacatac

Status:

Malicious

First seen:

2021-07-14 17:30:38 UTC

File Type:

PE (Exe)

AV detection:

25 of 46 (54.35%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=iyaopfi2jarsmi5ezhvk4iqj2ksw43ixjwnf3kbx7tcl4fb7m75a._file

Verdict:

malicious

Label(s):

doppeldridex

dridex

Result

Malware family:

dridex

Score:

10/10

Tags:

family:dridex botnet:22201 botnet evasion loader trojan

Link:

https://tria.ge/reports/210714-8hbvkp28bn/

Behaviour

Checks whether UAC is enabled

Dridex Loader

Dridex

Malware Config

C2 Extraction:

202.29.60.34:443
66.175.217.172:13786
78.46.78.42:9043

Unpacked files

SH256 hash:

d37a6fa5b04bba45a0d1e227c2935d346f243d8d090c0490d6ca2609a15390e1

MD5 hash:

4b4c6810154422fed142ee6593f17a19

SHA1 hash:

06a0977c6afe68fab71e9b2b3993ee4ccb3c6590

Detections:

win_doppeldridex_auto

Link:

https://www.unpac.me/results/bb9749c0-39ff-4a62-80bf-f80f7d67beec/

SH256 hash:

4600e7951a48232623a4c9eaae2209d2a56e6d174d9a5da837fcc4be143f67fa

MD5 hash:

a3cdbeb1d41c114bee6784c02ca42cd6

SHA1 hash:

dab99e5990cab0c9eb2cabd7fef6bd489d53bbd4

Link:

https://www.unpac.me/results/bb9749c0-39ff-4a62-80bf-f80f7d67beec/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

0.96

Link:

https://yomi.yoroi.company/submissions/4600e7951a48232623a4c9eaae2209d2a56e6d174d9a5da837fcc4be143f67fa

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.