MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 78f9c1f6ae02832ac63c6697f6089cc903119a206e7388bb662f02985fee3127. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Dridex

Vendor detections: 10

Intelligence 10 IOCs YARA 2 File information Comments

SHA256 hash:	78f9c1f6ae02832ac63c6697f6089cc903119a206e7388bb662f02985fee3127
SHA3-384 hash:	b2f4209e2d7e1916f5030407499f3db0caa15456b3f537c436e540b270de9f98434fbce34e00beb977759eccdab55519
SHA1 hash:	9e521d41d91082242aa811c8d4fb65bc8efdc8fc
MD5 hash:	bd4f52581f43477b31a387ed0b6a5684
humanhash:	princess-nuts-massachusetts-lactose
File name:	78f9c1f6ae02832ac63c6697f6089cc903119a206e7388bb662f02985fee3127
Download:	download sample
Signature	Dridex Create hunting rule
File size:	376'832 bytes
First seen:	2021-03-29 19:10:28 UTC
Last seen:	2021-03-29 21:44:10 UTC
File type:	dll
MIME type:	application/x-dosexec
imphash	10b339eba7ed6a12d0c67a18515a94ff (22 x Dridex)
ssdeep	6144:0bazNBbycfmKsyUlV6MdUFIk1KyHNwoAtpFp5xM6C1h:fzeTlV6/7HN+p5W6Uh
Threatray	683 similar samples on MalwareBazaar
TLSH	F984D01367D15031E6721F3848B389518AFF7DD28A34C9AB22C9115E2B277D05E78F6B
Reporter	Cryptolaemus1
Tags:	10444 Dridex

Cryptolaemus1

Dridex 10444

Intelligence

File Origin

# of uploads :

# of downloads :

137

Origin country :

n/a

Vendor Threat Intelligence

Detection:

DridexLoader

Link:

https://www.capesandbox.com/analysis/127792/

Detection(s):

SecuriteInfo.com.Trojan.Dridex.735.6809.19975.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Sending a UDP request

Sending a custom TCP request

Result

Verdict:

UNKNOWN

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Dridex

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/0a13680d-c2a4-4d82-9493-b5df36f4e047

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/78f9c1f6ae02832ac63c6697f6089cc903119a206e7388bb662f02985fee3127/

Threat name:

Win32.Worm.Cridex

Status:

Malicious

First seen:

2021-03-29 19:11:04 UTC

AV detection:

9 of 29 (31.03%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=pd44d5voakbsvrr4m2l7mce4zebrdgranzzyro3gf4bjqx7ogetq._file

Verdict:

malicious

Label(s):

dridex

gozi

Result

Malware family:

dridex

Score:

10/10

Tags:

family:dridex botnet:10444 botnet loader

Link:

https://tria.ge/reports/210329-7b8mskamxx/

Behaviour

Suspicious use of WriteProcessMemory

Dridex Loader

Dridex

Malware Config

C2 Extraction:

210.65.244.176:443
37.34.58.210:6601
77.220.64.141:5037

Unpacked files

SH256 hash:

f12da211e7e2d5ea88b4d498d112966990a3951b5d8b9617873a8b434ea10ae4

MD5 hash:

9b768574a299f1b2546e79d5ab6445c8

SHA1 hash:

bc52df44aeb2f2246bced4f1153a99c90a970561

Link:

https://www.unpac.me/results/4fdbe847-a7c2-48a4-8bf6-b3eea8ccad09/

SH256 hash:

78f9c1f6ae02832ac63c6697f6089cc903119a206e7388bb662f02985fee3127

MD5 hash:

bd4f52581f43477b31a387ed0b6a5684

SHA1 hash:

9e521d41d91082242aa811c8d4fb65bc8efdc8fc

Link:

https://www.unpac.me/results/4fdbe847-a7c2-48a4-8bf6-b3eea8ccad09/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/78f9c1f6ae02832ac63c6697f6089cc903119a206e7388bb662f02985fee3127

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.