MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7de08123f0b297781a5208f516fff7350f2c0797cb4eb75de8f00ec8d03d851e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Dridex


Vendor detections: 10


Intelligence 10 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7de08123f0b297781a5208f516fff7350f2c0797cb4eb75de8f00ec8d03d851e
SHA3-384 hash: b56a577833da57f72307ae97539fa01bafd77a6d143cc38837315190a90bd61aca0519518815ed5eb448e6877fa1ea29
SHA1 hash: b2e3387c7eeb5e3235d0bd512b7af9f09a3c25f0
MD5 hash: cc5a4c16bfc7eb7546fa5e7679c723b0
humanhash: montana-north-tennis-oscar
File name:qveoxuhz8.rar
Download: download sample
Signature Dridex
Create hunting rule
File size:583'680 bytes
First seen:2021-02-01 17:24:58 UTC
Last seen:2021-02-01 18:57:35 UTC
File type:DLL dll
MIME type:application/x-dosexec
imphash 992f83a6ac9ffc7fbfa3394931631eeb (11 x Dridex)
ssdeep 12288:Kvp6YjOHcxdxZkDZRFwurWjOZhpoSrpodTilnU6RV:Kvp7ycnbKJ3mduy
Threatray 391 similar samples on MalwareBazaar
TLSH 6BC4D0B8794084A5CC91403CF42CEAA8986D7CE7DE10A15372FF3F5F3B39991C565A1A
Reporter ov3rflow1
Tags:Dridex rar

Intelligence

File Origin
# of uploads :
2
# of downloads :
166
Origin country :
n/a
Vendor Threat Intelligence
Detection:
DridexLoader
Create hunting rule
Link:
https://www.capesandbox.com/analysis/114992/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
Sending a custom TCP request
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Unknown
Detection:
malicious
Classification:
n/a
Score:
48 / 100
Link:
https://www.joesandbox.com/analysis/595652
Signature
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 346873 Sample: qveoxuhz8.rar Startdate: 01/02/2021 Architecture: WINDOWS Score: 48 13 Multi AV Scanner detection for submitted file 2->13 7 unarchiver.exe 5 2->7         started        process3 process4 9 7za.exe 8 7->9         started        process5 11 conhost.exe 9->11         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/7de08123f0b297781a5208f516fff7350f2c0797cb4eb75de8f00ec8d03d851e/
Threat name:
Win32.Infostealer.Dridex
Create hunting rule
Status:
Malicious
First seen:
2021-02-01 16:57:28 UTC
AV detection:
5 of 46 (10.87%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=pxqici7qwklxqgssbd2rn77xguhsyb4xznhloxpi6ahmrub5qupa._file
Verdict:
malicious
Label(s):
dridex
Create hunting rule
Similar samples:
180a6935034ffeac72d7f1d0bd6fcb1efc21dda1b7408865a414a7ba683678f9
Dridex
255995667a9a05831875a40be90deb7249afc94628b9a1676d9c4b859968b3f9
Dridex
3a4bd219435b2324b3976dbb7b90789aa4a5cb17567bc6a7129d1e73bfaaa413
Dridex
4474c2ccab521311c533fb7c3088da9be624fc16474c2765eec2f4941a2e8557
Dridex
4b2a101f9e7e0119409b6faae798c1e9fada080f055509f477c598365e1f6618
Dridex
83c390d82e19beec14d007b7350f4296c23ce9b3d131a3670ebb7424ad917410
Dridex
867f3e4cb10d1456e17d0568db6f3c3931138a94677562b54d1697e561d6d753
Dridex
8b1203e7ff8ead64a388e8000955871b931202a9fd56ba339de65b01628fff6b
Dridex
b721618810b06ed4089d1469fc5c5b37be1a907fc1ae14222f913c6e2b0001c2
Dridex
dd6039f57c72056748007b0dd5070aa7deac990972d33e8a9d5118122e559590
Dridex
+ 381 additional samples on MalwareBazaar
Result
Malware family:
dridex
Create hunting rule
Score:
  10/10
Tags:
family:dridex botnet:10444 botnet discovery evasion loader trojan
Link:
https://tria.ge/reports/210201-hhc1cbnv4e/
Behaviour
Suspicious use of WriteProcessMemory
Checks installed software on the system
Checks whether UAC is enabled
Blocklisted process makes network request
Dridex Loader
Dridex
Malware Config
C2 Extraction:
77.220.64.131:443
5.196.204.251:5037
192.99.41.136:981
24.229.3.146:4664
Unpacked files
SH256 hash:
f2fb3480437219b929ad76f9fd9ef76040e7ade307af3df75151a022b830f086
MD5 hash:
96a2ce94fe92b15ba1d043195c337abb
SHA1 hash:
81fb19d6f466deb27a50e62965da9ff12ba0bccf
Link:
https://www.unpac.me/results/76156dd5-2dd5-455a-9984-abb5feb65afb/
SH256 hash:
7de08123f0b297781a5208f516fff7350f2c0797cb4eb75de8f00ec8d03d851e
MD5 hash:
cc5a4c16bfc7eb7546fa5e7679c723b0
SHA1 hash:
b2e3387c7eeb5e3235d0bd512b7af9f09a3c25f0
Link:
https://www.unpac.me/results/76156dd5-2dd5-455a-9984-abb5feb65afb/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/7de08123f0b297781a5208f516fff7350f2c0797cb4eb75de8f00ec8d03d851e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DridexLoader
Create hunting rule
Author:kevoreilly
Description:Dridex v4 dropper C2 parsing function
Rule name:win_dridex_loader_v2
Create hunting rule
Author:Johannes Bader @viql
Description:detects some Dridex loaders

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other
  
URLhaus
https://urlhaus.abuse.ch/url/986274/
  
URLhaus
https://urlhaus.abuse.ch/url/986267/
  
URLhaus
https://urlhaus.abuse.ch/url/986628/
  
URLhaus
https://urlhaus.abuse.ch/url/986664/
  
URLhaus
https://urlhaus.abuse.ch/url/986676/
  
URLhaus
https://urlhaus.abuse.ch/url/986694/
  
URLhaus
https://urlhaus.abuse.ch/url/986714/
  
URLhaus
https://urlhaus.abuse.ch/url/986726/
  
URLhaus
https://urlhaus.abuse.ch/url/986738/
Cape
Cape
https://www.capesandbox.com/analysis/114992/

Comments