MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4902830374b401c3a75fe1567c3e9a7a3efbdb2da587f0d97d3fd3fe17e50c80. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Dridex


Vendor detections: 7


Intelligence 7 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4902830374b401c3a75fe1567c3e9a7a3efbdb2da587f0d97d3fd3fe17e50c80
SHA3-384 hash: 10111ebb05e91241fbfb0441779152a2802e06b8f4c75a373771f4404a94cab241c8dd89ffef02319e4a4b4557e11d23
SHA1 hash: 0a7ceb5a578098734f84208d31e103bbf1ef6d3d
MD5 hash: 7892af30c1da21ebe84e516dc21cce5e
humanhash: sixteen-victor-east-bakerloo
File name:4902830374b401c3a75fe1567c3e9a7a3efbdb2da587f0d97d3fd3fe17e50c80
Download: download sample
Signature Dridex
Create hunting rule
File size:573'952 bytes
First seen:2021-03-31 12:46:32 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash c481640479b1f140aa694701dbc594d1 (10 x Dridex)
ssdeep 12288:MJfvOjRSY7eIDrMPhdLXhnkSx7lCUjw6DlHk+KAPV:2udrArayXDVk+5V
Threatray 701 similar samples on MalwareBazaar
TLSH C4C49E016962A039E8B386BE89FB564D46AEBD50073464DBB3CC985D1F6B6E17F30313
Reporter Cryptolaemus1
Tags:10444 Dridex


Avatar
Cryptolaemus1
Dridex 10444

Intelligence

File Origin
# of uploads :
1
# of downloads :
102
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/129272/
Detection(s):
SecuriteInfo.com.Program.Win32.Wacapew.Cml.30234.17248.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Sending a UDP request
Sending a custom TCP request
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Dridex
Create hunting rule
Detection:
malicious
Classification:
bank.troj.evad
Score:
76 / 100
Link:
https://www.joesandbox.com/analysis/660293
Signature
C2 URLs / IPs found in malware configuration
Detected Dridex e-Banking trojan
Found malware configuration
System process connects to network (likely due to code injection or exploit)
Yara detected Dridex unpacked file
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4902830374b401c3a75fe1567c3e9a7a3efbdb2da587f0d97d3fd3fe17e50c80/
Threat name:
Win32.Infostealer.Dridex
Create hunting rule
Status:
Malicious
First seen:
2021-03-31 12:47:16 UTC
AV detection:
8 of 29 (27.59%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=jebiga3uwqa4hj274flhypu2pi7pxwznuwd7bwl5h7j74f7fbsaa._file
Verdict:
malicious
Label(s):
dridex
Create hunting rule
Similar samples:
03bb64d1d0d91623bd8d83e769e97d39cf8175584dce06bc07936a8050ee4e41
Dridex
07ec5c0e81ff4f5073993471925cd8604464d169a4649f60bb493aea378f339d
Dridex
309c98cfae08598b25b5815a1191e156b61cb05472187a53e588ec48a6933142
Dridex
7bdf5dc022f15b27b4c18d5aab2dde8291bb6026b06da7567c8fb37a10a339b9
Dridex
7da1c3ac8c6431e32cd4d2fde7977e48808f6d60cd4a92a2d4ccfe4d9a67e6a7
Dridex
7f721141b9a5d5ee1bedc9729e3b5003cb2d161305b046090495b036e590394e
Dridex
8bf414ba5ed64f349bd7216efb27a0ce89e71f6d89ae7a2c3614ec1c19f6aff2
Dridex
b14b22fc9253aed0436977687ab1be627e96ab292b88e4f595a525eccd7b53c4
Dridex
b70c2ef369a1d977b56be1bdaa86446b97b6b293c238bd937f210ab3f1776d26
Dridex
dc764f5276566877f739be0dfafdf384e9e9afd978f6db0183bb127ae373dddd
Dridex
+ 691 additional samples on MalwareBazaar
Result
Malware family:
dridex
Create hunting rule
Score:
  10/10
Tags:
family:dridex botnet:10444 botnet loader
Link:
https://tria.ge/reports/210331-4cldydlxps/
Behaviour
Suspicious use of WriteProcessMemory
Dridex Loader
Dridex
Malware Config
C2 Extraction:
131.100.24.215:443
210.65.244.174:6601
195.201.199.53:2303
Unpacked files
SH256 hash:
9a8d2588a4a87756c2c177133888775459651670bc3ddd2f4347f8469fc28415
MD5 hash:
eb40587261dc2766eeb24faf89b19c00
SHA1 hash:
b3f713ef436dd72f268214c9f3378ddc95a85177
Link:
https://www.unpac.me/results/5833dae9-cf69-4bb3-9f45-44a6a894f607/
SH256 hash:
4902830374b401c3a75fe1567c3e9a7a3efbdb2da587f0d97d3fd3fe17e50c80
MD5 hash:
7892af30c1da21ebe84e516dc21cce5e
SHA1 hash:
0a7ceb5a578098734f84208d31e103bbf1ef6d3d
Link:
https://www.unpac.me/results/5833dae9-cf69-4bb3-9f45-44a6a894f607/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/4902830374b401c3a75fe1567c3e9a7a3efbdb2da587f0d97d3fd3fe17e50c80

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DridexLoader
Create hunting rule
Author:kevoreilly
Description:Dridex v4 dropper C2 parsing function
Rule name:win_dridex_loader_v2
Create hunting rule
Author:Johannes Bader @viql
Description:detects some Dridex loaders

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Dridex

DLL dll 4902830374b401c3a75fe1567c3e9a7a3efbdb2da587f0d97d3fd3fe17e50c80

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1100070/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/129272/

Comments