MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 796d5b97a9960b611b9c28370b27c526e20a9637ea615e857190a41a55442b0b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Dridex

Vendor detections: 7

Intelligence 7 IOCs YARA 2 File information Comments

SHA256 hash:	796d5b97a9960b611b9c28370b27c526e20a9637ea615e857190a41a55442b0b
SHA3-384 hash:	158cec44e5096e49c424f3023a9e0097d42063fde0c551b62ad70bf8f59ff5998f076b302a8d915875a711f2bbdfd2cb
SHA1 hash:	afe5062e9e316d83a7942a07096ac959259f7831
MD5 hash:	325b86fd2c630f2d0e88f239fcf45b1a
humanhash:	mississippi-grey-bluebird-jupiter
File name:	796d5b97a9960b611b9c28370b27c526e20a9637ea615e857190a41a55442b0b
Download:	download sample
Signature	Dridex Create hunting rule
File size:	577'536 bytes
First seen:	2021-03-01 14:12:19 UTC
Last seen:	2021-03-01 15:37:27 UTC
File type:	dll
MIME type:	application/x-dosexec
imphash	83861fb77ed2188363c53e94249a006f (6 x Dridex)
ssdeep	12288:ZieGWYv9l8BOdbZ5ECQGElFKxDvaqhR+ALF3:vu9OBOpZ5Qluvaa
Threatray	489 similar samples on MalwareBazaar
TLSH	17C48C04B665C076F47690B9DC62C7FDA9993C61CF2884D7B6D22F1F713E5A0A932223
Reporter	Cryptolaemus1
Tags:	10444 Dridex

Cryptolaemus1

Dridex 10444

Intelligence

File Origin

# of uploads :

# of downloads :

128

Origin country :

n/a

Vendor Threat Intelligence

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/120317/

Detection(s):

SecuriteInfo.com.ML.PE-A.4418.2274.UNOFFICIAL

Result

Verdict:

Clean

Maliciousness:

Behaviour

Sending a UDP request

Sending a custom TCP request

Result

Verdict:

UNKNOWN

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/796d5b97a9960b611b9c28370b27c526e20a9637ea615e857190a41a55442b0b/

Threat name:

Win32.Infostealer.Dridex

Status:

Malicious

First seen:

2021-03-01 14:13:14 UTC

File Type:

PE (Dll)

Extracted files:

AV detection:

15 of 29 (51.72%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=pfwvxf5jsyfwcg44fa3qwj6fe3ravfrx5jqv5blrscsbuvkefmfq._file

Verdict:

malicious

Label(s):

dridex

Result

Malware family:

dridex

Score:

10/10

Tags:

family:dridex botnet:10444 botnet loader

Link:

https://tria.ge/reports/210301-xhzphy2jp6/

Behaviour

Suspicious use of WriteProcessMemory

Dridex Loader

Dridex

Malware Config

C2 Extraction:

77.220.64.146:443
85.25.134.43:8172
213.208.134.178:6516

Unpacked files

SH256 hash:

5f576c1edb68641df254cd5afaf1d8df893a794c4ecf7e63c00b9539ace3aad5

MD5 hash:

249c2eda34083523d6a1e6f99d1ec29b

SHA1 hash:

63238c5cf78c6c5149e4023138437e63625af937

Link:

https://www.unpac.me/results/7724d8d9-feee-4387-b143-0436bf4ebe6a/

SH256 hash:

796d5b97a9960b611b9c28370b27c526e20a9637ea615e857190a41a55442b0b

MD5 hash:

325b86fd2c630f2d0e88f239fcf45b1a

SHA1 hash:

afe5062e9e316d83a7942a07096ac959259f7831

Link:

https://www.unpac.me/results/7724d8d9-feee-4387-b143-0436bf4ebe6a/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/796d5b97a9960b611b9c28370b27c526e20a9637ea615e857190a41a55442b0b

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.