MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 53feb63b67f82bcbcd2a1301fb3dc5b3fc74a2b84f98ed529a77c777d0c2ac70. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Dridex


Vendor detections: 8


Intelligence 8 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 53feb63b67f82bcbcd2a1301fb3dc5b3fc74a2b84f98ed529a77c777d0c2ac70
SHA3-384 hash: 5575483b04d38d11010c26253a9ab599b3f76904e2a9a888714ac60fcb605235f4fdfd418925d57ea001013a81b38e7e
SHA1 hash: 11642fd8ac02a6592cabe5beb9e7d0166577c896
MD5 hash: 62058d6dd5b36c0b85224e6f1cc05fb5
humanhash: hotel-finch-wyoming-moon
File name:62058d6dd5b36c0b85224e6f1cc05fb5.dll
Download: download sample
Signature Dridex
Create hunting rule
File size:192'512 bytes
First seen:2021-02-22 19:16:09 UTC
Last seen:2021-02-22 20:29:51 UTC
File type:DLL dll
MIME type:application/x-dosexec
imphash 421eddade4a7740c852f0d30032122f7 (1 x Dridex)
ssdeep 3072:Y6yaqXFrEQUu1L3Khnx0quKiHlaeqP3ssWPTRX3fW8363nHaDaI+XB:Y0qX6u1LaVjOk8TW8Da
Threatray 92 similar samples on MalwareBazaar
TLSH 7414DF1197FF60E4F5B3AF35693A62621E47BED299BCD88DA310139DD825760C920B33
Reporter abuse_ch
Tags:dll Dridex

Intelligence

File Origin
# of uploads :
2
# of downloads :
142
Origin country :
n/a
Vendor Threat Intelligence
Detection:
DridexV4
Create hunting rule
Link:
https://www.capesandbox.com/analysis/118400/
Detection(s):
SecuriteInfo.com.W32.AIDetectGBM.malware.01.5799.23964.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
DNS request
Sending a UDP request
Result
Threat name:
Dridex
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
76 / 100
Link:
https://www.joesandbox.com/analysis/614502
Signature
C2 URLs / IPs found in malware configuration
Found malware configuration
Machine Learning detection for sample
System process connects to network (likely due to code injection or exploit)
Tries to detect sandboxes / dynamic malware analysis system (file name check)
Yara detected Dridex unpacked file
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/53feb63b67f82bcbcd2a1301fb3dc5b3fc74a2b84f98ed529a77c777d0c2ac70/
Threat name:
Win32.Trojan.BankerX
Create hunting rule
Status:
Malicious
First seen:
2021-02-22 19:17:04 UTC
AV detection:
10 of 29 (34.48%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=kp7lmo3h7av4xtjkcma7wpofwp6hjivyj6mo2uu2o7dxpugcvrya._file
Verdict:
suspicious
Similar samples:
00cbdefe7dda0c470d03e1d386acdef065ab738abe0641a42b1ad3d711940914
Dridex
3edf8fa45c0ae46229ba3fd68d3dbf05a00e1e3c49cb0d4d5005409b929570e2
Dridex
3fde380555135b231bdff61f8ff4a28169e4df0c6b9eab4378cbf50160f3a235
Dridex
69270306507c02cbcfc8c8432e4cfbe1888c7b23decd2d659caf9375e153713a
Dridex
a6c0c1e180453c757a95e0f6800cf35e80c31a1d277a0a021ff313bb6f23c952
Dridex
cd7697dbe4ec3ecda59bcaf4a8d15de4cbb2cbed88b3b852fd73926cf040b68b
Dridex
cdc6fdc6cfa18d26713eba66ebe9e3885bea2d8e48f049293706de870126743b
Dridex
d0cb82a9f20bb544184fb26f843022774bc9d286c65fbc3ccb839f480d573573
Dridex
d3e4a34d13bbfccea5715e95b34c4b2a61b9c920752865add848cd43eac04869
Dridex
f62e65a5b9edfeef3217d3e131f8eb63aac24cfdc325f50a4bcdcbb18236196a
Dridex
+ 82 additional samples on MalwareBazaar
Result
Malware family:
dridex
Create hunting rule
Score:
  10/10
Tags:
family:dridex botnet:111 botnet discovery evasion loader trojan
Link:
https://tria.ge/reports/210222-wnbmkgrt42/
Behaviour
Suspicious use of WriteProcessMemory
Checks installed software on the system
Checks whether UAC is enabled
Blocklisted process makes network request
Dridex Loader
Dridex
Malware Config
C2 Extraction:
162.13.114.59:443
70.39.99.196:8172
37.187.115.122:6601
Unpacked files
SH256 hash:
f905829a77e90fa33fa58dd6aa792a3a3b2be0a0fdb83afd8f6d8657c98a3f2f
MD5 hash:
c5b1bef8d22f04f47537d98ca1180a38
SHA1 hash:
afdd09fc65ff4b7f84b5a588af7e6278725558e3
Detections:
win_dridex_auto
Create hunting rule
Link:
https://www.unpac.me/results/ad108388-1993-4b81-a7d4-ab5b8e04139f/
SH256 hash:
8ccd4afca9a0330d624997b1badb59e85b34ccd97bd2949d436f03d44a226afb
MD5 hash:
85170a335c8d446829fac30d08a6088d
SHA1 hash:
a1ea6f82c62ce5ca927a0667f853dc03220cbdac
Link:
https://www.unpac.me/results/ad108388-1993-4b81-a7d4-ab5b8e04139f/
SH256 hash:
53feb63b67f82bcbcd2a1301fb3dc5b3fc74a2b84f98ed529a77c777d0c2ac70
MD5 hash:
62058d6dd5b36c0b85224e6f1cc05fb5
SHA1 hash:
11642fd8ac02a6592cabe5beb9e7d0166577c896
Link:
https://www.unpac.me/results/ad108388-1993-4b81-a7d4-ab5b8e04139f/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Dridex
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/53feb63b67f82bcbcd2a1301fb3dc5b3fc74a2b84f98ed529a77c777d0c2ac70

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DridexV4
Create hunting rule
Author:kevoreilly
Description:Dridex v4 Payload
Rule name:MALWARE_Win_DLLLoader
Create hunting rule
Author:ditekSHen
Description:Detects unknown DLL Loader
Rule name:win_dridex_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Dridex

DLL dll 53feb63b67f82bcbcd2a1301fb3dc5b3fc74a2b84f98ed529a77c777d0c2ac70

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1024278/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/118400/

Comments