MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 96b12040d044830cf41890f2806c935ae4e9f8c572c41a5ed3e4551b16403508. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Dridex

Vendor detections: 10

Intelligence 10 IOCs YARA 2 File information Comments

SHA256 hash:	96b12040d044830cf41890f2806c935ae4e9f8c572c41a5ed3e4551b16403508
SHA3-384 hash:	c09c2e9d716557d86d20a093f13e3abf2e2c5765f23a204e572cc8e9dbf87981fc33b3997beecdacba203c51074d2eeb
SHA1 hash:	039ee29cf08222cd723d68211a1951c7e6edfeb1
MD5 hash:	e3811e87a0f66d9fe5bb08ed27e1e7f2
humanhash:	helium-papa-seven-batman
File name:	buiad8ek6.rar
Download:	download sample
Signature	Dridex Create hunting rule
File size:	589'824 bytes
First seen:	2021-02-07 23:23:50 UTC
Last seen:	2021-02-08 00:49:46 UTC
File type:	dll
MIME type:	application/x-dosexec
imphash	51b27f4568531763800428bfda4cfb55 (2 x Dridex)
ssdeep	12288:wAEJhkFK62GbYs054M795+voCUxusp39b6nf/DhMsNNUqXAnT:wdJS2GN0aY5goao9b6nt9NRQnT
Threatray	428 similar samples on MalwareBazaar
TLSH	D7C4E0B8B94094A9CC81003CF828FA58D49D7CE78F10E153B2FF3E5F777A9918555A2A
Reporter	opexxx
Tags:	Dridex

Intelligence

File Origin

# of uploads :

# of downloads :

131

Origin country :

n/a

Vendor Threat Intelligence

Detection:

DridexLoader

Link:

https://www.capesandbox.com/analysis/115993/

Detection(s):

SecuriteInfo.com.Trojan.Dridex.735.30073.6381.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Sending a UDP request

Sending a custom TCP request

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Result

Threat name:

Unknown

Detection:

malicious

Classification:

n/a

Score:

52 / 100

Link:

https://www.joesandbox.com/analysis/601381

Signature

Machine Learning detection for sample

Multi AV Scanner detection for submitted file

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/96b12040d044830cf41890f2806c935ae4e9f8c572c41a5ed3e4551b16403508/

Threat name:

Win32.Infostealer.Dridex

Status:

Malicious

First seen:

2021-02-02 06:47:55 UTC

AV detection:

23 of 29 (79.31%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=s2ysaqgqisbqz5aysdzia3etllsot6gfolcbuxwt4rkrwfsaguea._file

Verdict:

malicious

Label(s):

dridex

Result

Malware family:

dridex

Score:

10/10

Tags:

family:dridex botnet:10444 botnet discovery evasion loader trojan

Link:

https://tria.ge/reports/210207-7jwesmb9qe/

Behaviour

Suspicious use of WriteProcessMemory

Checks installed software on the system

Checks whether UAC is enabled

Blocklisted process makes network request

Dridex Loader

Dridex

Malware Config

C2 Extraction:

77.220.64.131:443
5.196.204.251:5037
192.99.41.136:981
24.229.3.146:4664

Unpacked files

SH256 hash:

d4e115bc6a65e58ca9b39f0e90c9079dc06111554f3b56892e932627e728e739

MD5 hash:

3ebbac9dacfeeea83e0040d808e3ba36

SHA1 hash:

7b1b6ad4d508cfb8cffeb78531615f323e183487

Link:

https://www.unpac.me/results/1f5a7834-0f23-426a-aa1c-3a16f3ae37cb/

SH256 hash:

96b12040d044830cf41890f2806c935ae4e9f8c572c41a5ed3e4551b16403508

MD5 hash:

e3811e87a0f66d9fe5bb08ed27e1e7f2

SHA1 hash:

039ee29cf08222cd723d68211a1951c7e6edfeb1

Link:

https://www.unpac.me/results/1f5a7834-0f23-426a-aa1c-3a16f3ae37cb/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Dridex

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/96b12040d044830cf41890f2806c935ae4e9f8c572c41a5ed3e4551b16403508

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.