MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 61ec25c0d71e16e8208d3b2ccb2c7f7b9f5580c992e538d256393d8085919560. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Dridex


Vendor detections: 7


Intelligence 7 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 61ec25c0d71e16e8208d3b2ccb2c7f7b9f5580c992e538d256393d8085919560
SHA3-384 hash: 086de26a3a17808c1a2d2526ccd4abb600348acd550c5845e028718c2942300cec92d2e4a0f14b8efcaaee5bbcbc6534
SHA1 hash: 091d5f6d69be3b52cbe9dc5976092a420ed6cbdd
MD5 hash: 94125438dc1fcccd0c80567f0187718b
humanhash: hotel-happy-california-diet
File name:g78zqs1w.rar.dll
Download: download sample
Signature Dridex
Create hunting rule
File size:605'016 bytes
First seen:2020-10-29 14:04:05 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash f1ff86ce36c6f496da208248090081e2 (1 x Dridex)
ssdeep 12288:OnB7XOyfxyhntvHyBCtAnHgskuJY/6AFuuY0tn:OnB+OxyfQu4Xle68Y0tn
Threatray 40 similar samples on MalwareBazaar
TLSH 6AD4292369D2CF14D07E00F7C9FD6AB81730ED285D688E2DB76AB969F973544294032E
Reporter James_inthe_box
Tags:dll Dridex

Code Signing Certificate

Organisation:HAAOSDFJPRNHPMLXGS
Issuer:HAAOSDFJPRNHPMLXGS
Algorithm:sha1WithRSA
Valid from:Oct 29 05:54:45 2020 GMT
Valid to:Dec 31 23:59:59 2039 GMT
Serial number: 5923B46712080EB541B750940A7FA018
Thumbprint Algorithm:SHA256
Thumbprint: 35615A0362CC99B9C8DF315DAA09B0AD19C7D25080E7003F2AEF1B8280FFB97C
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin
# of uploads :
1
# of downloads :
90
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/80974/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
Result
Threat name:
Unknown
Detection:
malicious
Classification:
n/a
Score:
48 / 100
Link:
https://www.joesandbox.com/analysis/516136
Signature
A
b
c
d
e
f
i
l
M
n
o
r
S
t
u
V
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/61ec25c0d71e16e8208d3b2ccb2c7f7b9f5580c992e538d256393d8085919560/
Threat name:
Win32.Infostealer.Dridex
Create hunting rule
Status:
Malicious
First seen:
2020-10-29 14:03:41 UTC
File Type:
PE (Dll)
Extracted files:
152
AV detection:
22 of 27 (81.48%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=mhwclqgxdyloqienhmwmwld7popvlagjslstruswhe6ybbmrsvqa._file
Verdict:
malicious
Label(s):
dridex
Create hunting rule
Similar samples:
51acefd32d0606f3059320b05197fe99f121a22dec166964ae6f447854f5c82c
Dridex
59b1087ec423c56cba3ca5ef050b8f86a9fb22ddddcf096ca6d92363efaabe2f
Dridex
6b34671b04872cfde098c319f20693021a43ddb8b00f989669778e745e5232a4
Dridex
7f9d34e81d9dbaadf5253b219f04a1702226072884521a8e12e8c99c49fe198e
Dridex
857b5c1209e2bec7dda0c80b92123f4ceb15f8c560f23551804e4bd09b94e901
Dridex
9bea5cd43e299b1dcf722ab63d3162d0efaa6acd561260c9f5323dbc9ce71383
Dridex
a50ac006054905d1f7fb342ba9053b5cecd381b67c54c9cab365f9b4eca2ee1b
Dridex
adf6d91922505e07b840cdd9f74d33d6c7872bc6534a9be6b27b5d03470c835b
Dridex
b2a09b4f89680c9980ecbfcc4fdd0256f1d615e46660d1529ad95c6efe77b31a
Dridex
ef93251e31ce7ce387898be4ce0d7acf735f8e21ae9e6f453d6e2cd594e96bcb
Dridex
+ 30 additional samples on MalwareBazaar
Result
Malware family:
dridex
Create hunting rule
Score:
  10/10
Tags:
family:dridex botnet discovery evasion loader trojan
Link:
https://tria.ge/reports/201029-xqjc2a8wes/
Behaviour
Suspicious use of WriteProcessMemory
Checks installed software on the system
Checks whether UAC is enabled
Blacklisted process makes network request
Dridex Loader
Dridex
Malware Config
C2 Extraction:
77.220.64.55:443
51.254.163.104:1688
165.22.65.75:3388
103.41.110.115:33443
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other
Cape
Cape
https://www.capesandbox.com/analysis/80974/
  
URLhaus
https://urlhaus.abuse.ch/url/765446/

Comments