MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 85e89192cb6620876fbd1737641340e1f5996dffd1f8f1793922121ba5c26a74. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Dridex

Vendor detections: 10

Intelligence 10 IOCs YARA 2 File information Comments

SHA256 hash:	85e89192cb6620876fbd1737641340e1f5996dffd1f8f1793922121ba5c26a74
SHA3-384 hash:	2cebbcaa83ff0db0d7a7898cc8186fc61322134fa9c7ab2b0aecad837d5ced4521ef2157722b787dd8b97acc97d29f9d
SHA1 hash:	a41ef77065ed3ec6610b786c0953337441c46684
MD5 hash:	98ab916b246da6604f5467dccf3c4da3
humanhash:	indigo-ceiling-hotel-johnny
File name:	98ab916b246da6604f5467dccf3c4da3.dll
Download:	download sample
Signature	Dridex Create hunting rule
File size:	583'680 bytes
First seen:	2021-02-01 18:13:56 UTC
Last seen:	2021-02-01 18:57:53 UTC
File type:	dll
MIME type:	application/x-dosexec
imphash	992f83a6ac9ffc7fbfa3394931631eeb (11 x Dridex)
ssdeep	12288:zvp6YjOHcxdxZkDZRFwurWjOZhpoSrpodTilnUORV:zvp7ycnbKJ3mduy
Threatray	393 similar samples on MalwareBazaar
TLSH	10C4D0B8794084A5CC91403CF42CEAA8986D7CE7DE10A15372FF3F5F3B39992C565A1A
Reporter	abuse_ch
Tags:	dll Dridex

Intelligence

File Origin

# of uploads :

# of downloads :

163

Origin country :

n/a

Vendor Threat Intelligence

Detection:

DridexLoader

Link:

https://www.capesandbox.com/analysis/115002/

Result

Verdict:

Malware

Maliciousness:

Behaviour

Sending a UDP request

Sending a custom TCP request

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Result

Threat name:

Unknown

Detection:

malicious

Classification:

n/a

Score:

56 / 100

Link:

https://www.joesandbox.com/analysis/595727

Signature

Found malware configuration

Multi AV Scanner detection for submitted file

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/85e89192cb6620876fbd1737641340e1f5996dffd1f8f1793922121ba5c26a74/

Threat name:

Win32.Infostealer.Dridex

Status:

Malicious

First seen:

2021-02-01 16:57:28 UTC

AV detection:

5 of 46 (10.87%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=qxujdewlmyqio355c43wie2a4h2zs3p72h4pc6jzeijbxjocnj2a._file

Verdict:

malicious

Label(s):

dridex

Result

Malware family:

dridex

Score:

10/10

Tags:

family:dridex botnet:10444 botnet discovery evasion loader trojan

Link:

https://tria.ge/reports/210201-lftw9jj2ye/

Behaviour

Suspicious use of WriteProcessMemory

Checks installed software on the system

Checks whether UAC is enabled

Blocklisted process makes network request

Dridex Loader

Dridex

Malware Config

C2 Extraction:

77.220.64.131:443
5.196.204.251:5037
192.99.41.136:981
24.229.3.146:4664

Unpacked files

SH256 hash:

ac39608b9ba66637e094b7db0049eecd7f17c3d17b834e245e72d40286f6e208

MD5 hash:

94d92d7cb4718256012056d85f1fb417

SHA1 hash:

fb511061aa29c63cfbae61b85c1d1796ce996b86

Link:

https://www.unpac.me/results/1c085038-96f9-456c-b019-95319ec7cf78/

SH256 hash:

85e89192cb6620876fbd1737641340e1f5996dffd1f8f1793922121ba5c26a74

MD5 hash:

98ab916b246da6604f5467dccf3c4da3

SHA1 hash:

a41ef77065ed3ec6610b786c0953337441c46684

Link:

https://www.unpac.me/results/1c085038-96f9-456c-b019-95319ec7cf78/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Glupteba

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/85e89192cb6620876fbd1737641340e1f5996dffd1f8f1793922121ba5c26a74

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.