MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 634d5436c366be5ff9e307c39f6d73b2ac0427fc7d564e6ad5125cb1c88a18f9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Dridex


Vendor detections: 4


Intelligence 4 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 634d5436c366be5ff9e307c39f6d73b2ac0427fc7d564e6ad5125cb1c88a18f9
SHA3-384 hash: eab548578f99c5cd3c94fe61dae9721ad6dcb396ea0fd0412b1301d9f82d13e25996af34d0bb75d5379448b903afa85e
SHA1 hash: a060cf4bb6a4e1c68070b125fee3c3cc61887e60
MD5 hash: 77d0870b0802528b7e70291f3f71eb86
humanhash: arizona-victor-london-michigan
File name:77d0870b_by_Libranalysis
Download: download sample
Signature Dridex
Create hunting rule
File size:165'376 bytes
First seen:2021-05-05 19:07:10 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash fe65a1f7486a2b7fbd4091fc108e3b31 (574 x Dridex, 1 x Gozi)
ssdeep 3072:9w45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:+4KcMhVkbK3hDq9E8i
Threatray 154 similar samples on MalwareBazaar
TLSH 31F3C085DBABE87FC44A35399071DFFB5B388B145240C870EB6969EFCA07B110856C83
Reporter Libranalysis
Tags:Dridex


Avatar
Libranalysis
Uploaded as part of the sample sharing project

Intelligence

File Origin
# of uploads :
1
# of downloads :
58
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Mal.EncPk-APX.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Sending a UDP request
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/634d5436c366be5ff9e307c39f6d73b2ac0427fc7d564e6ad5125cb1c88a18f9/
Threat name:
Win32.Trojan.GenericML
Create hunting rule
Status:
Malicious
First seen:
2021-05-05 19:08:13 UTC
AV detection:
15 of 29 (51.72%)
Threat level:
  5/5
Verdict:
unknown
Similar samples:
665da24ec510b6c981f13caa585b8b55c20b4448b6a56f3faed6fb5ff3128862
Dridex
76af3c4ddae1bb5c3401f18f79f29b295ee671401b224095dd82db5bb7a0199c
Dridex
7fc785b09122d5aa45cb403b468f7ee3d5bb8904e1f8da25a95053384eb606ba
Dridex
8789f7d53922182436d7fba64e567a00a7996fd38ec1c2113f4e99f48d159432
Dridex
9c8e4d921fe58d8c5891e4e798491323c38ef50e1abb2d402c14cf3e3e73ef0c
Dridex
b1c932b82e70544a381a0a0ffe1116a71a0dbc1c2b3e5afd63d7ddd0507489ca
Dridex
c2feca835d3ef43bf5f97c6b32b59e63c39cc169fad1fb88174894b74708ff05
Dridex
c369a4aca81eae4b0a4026485360cdbd6a88cdafe414726802d5b6a622294e73
Dridex
f2f107d65d74ee1978c27a650fba33b690768d7090ed7177b0e44e7349d4a31a
Dridex
fa4597b75c708c94cb5828dfd5883a7e1bb9a5b94e978aca1f77471f99c2a3e1
Dridex
+ 144 additional samples on MalwareBazaar
Result
Malware family:
dridex
Create hunting rule
Score:
  10/10
Tags:
family:dridex botnet:22201 botnet loader
Link:
https://tria.ge/reports/210505-8y9xyljkyn/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Dridex Loader
Dridex
Malware Config
C2 Extraction:
45.55.134.126:443
67.207.83.96:8172
193.160.214.95:4125
Unpacked files
SH256 hash:
634d5436c366be5ff9e307c39f6d73b2ac0427fc7d564e6ad5125cb1c88a18f9
MD5 hash:
77d0870b0802528b7e70291f3f71eb86
SHA1 hash:
a060cf4bb6a4e1c68070b125fee3c3cc61887e60
Link:
https://www.unpac.me/results/45ab56f7-24c7-4fcd-82f7-efa33b721e47/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/634d5436c366be5ff9e307c39f6d73b2ac0427fc7d564e6ad5125cb1c88a18f9

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DridexLoader
Create hunting rule
Author:kevoreilly
Description:Dridex v4 dropper C2 parsing function
Rule name:DridexV4
Create hunting rule
Author:kevoreilly
Description:Dridex v4 Payload
Rule name:MALWARE_Win_DLLLoader
Create hunting rule
Author:ditekSHen
Description:Detects unknown DLL Loader
Rule name:win_dridex_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments