MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 50baa24d4192b82ad552b3c091332011074a5a399f375b7ad1663a6a65637dbd. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Dridex


Vendor detections: 7


Intelligence 7 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 50baa24d4192b82ad552b3c091332011074a5a399f375b7ad1663a6a65637dbd
SHA3-384 hash: 346cb7a4637ad204a0a3b2b85f8975f180c9815b27800c8a5dbcf7e1fedfbbf799efb6c5c3404f6a9791557214466c7a
SHA1 hash: 6a23d0337a0515d1ecc2119df5c98939c3ddffc6
MD5 hash: b7db263c652f1f02032b601ed1b5b60b
humanhash: fillet-island-oregon-carolina
File name:hffv7hy2.zip.dll
Download: download sample
Signature Dridex
Create hunting rule
File size:928'768 bytes
First seen:2021-01-25 15:31:02 UTC
Last seen:2021-01-25 18:14:19 UTC
File type:DLL dll
MIME type:application/x-dosexec
imphash 356b1aa4640e3e630debf0f6e3180709 (12 x Dridex)
ssdeep 12288:YNb4m1ZfLaDI9m8JnbHIRvujOFvUQuIVan2vUggyyt/KVE1lSZsCpieuvCm5:Ikm1ZwsHnbH/OBUOtM5ljH
Threatray 1 similar samples on MalwareBazaar
TLSH F915F161FE91A438EF2D12344C2BECB80666FD041E69FC6F31DE1E5B1162362F516798
Reporter JAMESWT_WT
Tags:dll Dridex

Intelligence

File Origin
# of uploads :
3
# of downloads :
152
Origin country :
n/a
Vendor Threat Intelligence
Detection:
DridexLoader
Create hunting rule
Link:
https://www.capesandbox.com/analysis/113735/
Detection(s):
SecuriteInfo.com.Generic.mg.b7db263c652f1f02.22018.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
Sending a custom TCP request
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
56 / 100
Link:
https://www.joesandbox.com/analysis/589763
Signature
Multi AV Scanner detection for submitted file
System process connects to network (likely due to code injection or exploit)
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 343931 Sample: hffv7hy2.zip.dll Startdate: 25/01/2021 Architecture: WINDOWS Score: 56 33 Multi AV Scanner detection for submitted file 2->33 8 loaddll32.exe 1 2->8         started        process3 process4 10 regsvr32.exe 12 8->10         started        14 cmd.exe 1 8->14         started        dnsIp5 27 158.69.118.130, 1443, 49768, 49772 OVHFR Canada 10->27 29 45.33.94.33, 49766, 49770, 49774 LINODE-APLinodeLLCUS United States 10->29 31 2 other IPs or domains 10->31 35 System process connects to network (likely due to code injection or exploit) 10->35 16 iexplore.exe 2 74 14->16         started        signatures6 process7 process8 18 iexplore.exe 147 16->18         started        dnsIp9 21 tls13.taboola.map.fastly.net 151.101.1.44, 443, 49742, 49743 FASTLYUS United States 18->21 23 www.msn.com 18->23 25 7 other IPs or domains 18->25
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/50baa24d4192b82ad552b3c091332011074a5a399f375b7ad1663a6a65637dbd/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=kc5ketkbsk4cvvkswpajcmzaceduuwrzt43vw6wrmy5guzldpw6q._file
Verdict:
unknown
Similar samples:
fa88b6a5ab9879364ce214e6356052acbabe535c47be3c066f9c3c952af83bbe
Dridex
Result
Malware family:
dridex
Create hunting rule
Score:
  10/10
Tags:
family:dridex botnet discovery evasion loader trojan
Link:
https://tria.ge/reports/210125-dkkzvf7bd6/
Behaviour
Suspicious use of WriteProcessMemory
Checks installed software on the system
Checks whether UAC is enabled
Blocklisted process makes network request
Dridex Loader
Dridex
Malware Config
C2 Extraction:
97.107.127.161:443
45.33.94.33:5037
159.89.91.92:5037
158.69.118.130:1443
Unpacked files
SH256 hash:
01529603513b25d7be244da618879709fdf8740d3345eedc9341280ed1b05d31
MD5 hash:
a50a05366d52865eca05bee94a652afa
SHA1 hash:
9e0703821ac5ff4fb7122d62cce7ddb63b1c4a3c
Link:
https://www.unpac.me/results/51be3eff-309e-463c-ac7e-53ea2a032e3c/
SH256 hash:
50baa24d4192b82ad552b3c091332011074a5a399f375b7ad1663a6a65637dbd
MD5 hash:
b7db263c652f1f02032b601ed1b5b60b
SHA1 hash:
6a23d0337a0515d1ecc2119df5c98939c3ddffc6
Link:
https://www.unpac.me/results/51be3eff-309e-463c-ac7e-53ea2a032e3c/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/50baa24d4192b82ad552b3c091332011074a5a399f375b7ad1663a6a65637dbd

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DridexLoader
Create hunting rule
Author:kevoreilly
Description:Dridex v4 dropper C2 parsing function
Rule name:win_dridex_loader_v2
Create hunting rule
Author:Johannes Bader @viql
Description:detects some Dridex loaders

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Dridex

DLL dll 50baa24d4192b82ad552b3c091332011074a5a399f375b7ad1663a6a65637dbd

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/977466/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/113735/
  
URLhaus
https://urlhaus.abuse.ch/url/977519/

Comments