MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4ce26282f83432de636ae643ef81249a9f39851ae1283e9e84ab1311cb47a584. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Dridex


Vendor detections: 6


Intelligence 6 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4ce26282f83432de636ae643ef81249a9f39851ae1283e9e84ab1311cb47a584
SHA3-384 hash: 70bda52ce7adb98105af8db67d731c3cdc3d714b76036c225a79dfca06587bd229c3950a7d2b7386ffa953f288ca0fbb
SHA1 hash: 16dcbd26f5d5c276de8ebc8cd9ec0fd26b5f7d2d
MD5 hash: d4d6d6b90b532bd131b17e13341a16f5
humanhash: jupiter-london-friend-magnesium
File name:593e422538a9d74db184447b9367de77
Download: download sample
Signature Dridex
Create hunting rule
File size:552'960 bytes
First seen:2020-11-17 11:39:21 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash 7708ea63db3d79977009177fb2619bd2 (1 x Dridex)
ssdeep 6144:PheCJAryLKFhmt4zG52JS5+fOcY8of8GLMuPevX8uY7+eWnSPodzFA2I6rID7f0a:NJAuLKW4zGjKuc+yeWSP0K1SE
TLSH DCC4DF52B6F676D8E2FEBF721DBD02241DB8BD15DC7CC16F1682402E8A68F418932761
Reporter seifreed
Tags:Dridex

Intelligence

File Origin
# of uploads :
1
# of downloads :
87
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Malware.Bankerx-9787378-0
Create hunting rule

Win.Trojan.Generic-9787381-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Launching a process
Searching for the window
Creating a window
Changing a file
Forced system process termination
DNS request
Sending a custom TCP request
Forced shutdown of a system process
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4ce26282f83432de636ae643ef81249a9f39851ae1283e9e84ab1311cb47a584/
Threat name:
Win32.Infostealer.Dridex
Create hunting rule
Status:
Malicious
First seen:
2020-11-17 11:42:06 UTC
AV detection:
26 of 28 (92.86%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
dridex
Create hunting rule
Result
Malware family:
dridex
Create hunting rule
Score:
  10/10
Tags:
family:dridex botnet evasion loader persistence trojan
Link:
https://tria.ge/reports/201117-9jpkqq3zn2/
Behaviour
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Checks SCSI registry key(s)
Enumerates system info in registry
Modifies Control Panel
Suspicious use of SetWindowsHookEx
Checks whether UAC is enabled
Enumerates connected drives
Modifies Installed Components in the registry
Dridex Loader
Dridex
Unpacked files
SH256 hash:
4ce26282f83432de636ae643ef81249a9f39851ae1283e9e84ab1311cb47a584
MD5 hash:
d4d6d6b90b532bd131b17e13341a16f5
SHA1 hash:
16dcbd26f5d5c276de8ebc8cd9ec0fd26b5f7d2d
Link:
https://www.unpac.me/results/ccfca60b-97fe-43da-9963-fa18a1ca74f9/
SH256 hash:
75443e20a7c107c4f7fb9e19f51476b155f76fb162d3df9d345383f255d9cac7
MD5 hash:
9e438cc2fb5524319e8456b25b10ded4
SHA1 hash:
45879016fb79c400c047e22fd3ce7a4aa1a9265a
Detections:
win_dridex_auto
Create hunting rule
Link:
https://www.unpac.me/results/ccfca60b-97fe-43da-9963-fa18a1ca74f9/
SH256 hash:
1865900af9b33dfa6f2e1a8d186015ecb7b1752937b30d028e0c7fb7368e637e
MD5 hash:
0ac6bec3a4fceca32f6dd08ddf0b4ce2
SHA1 hash:
b44b128b9a5d95ca70974ba74a4e97dc7615c12e
Detections:
win_dridex_auto
Create hunting rule
Link:
https://www.unpac.me/results/ccfca60b-97fe-43da-9963-fa18a1ca74f9/
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:win_dridex_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other

Comments