MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9f38af84820dc29e805029409bbb2a5765036775973e3898b6db1f66c1b47270. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Dridex


Vendor detections: 7


Intelligence 7 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9f38af84820dc29e805029409bbb2a5765036775973e3898b6db1f66c1b47270
SHA3-384 hash: 6f37871df6bcbaa29ad72d6eb6c76ea8e4e6a30e860bd43dfac34e3621180b84a32c78001a46154e94115e8d2f699703
SHA1 hash: d6b121e7a8ed0e94c2e89e33ea6828290f858e90
MD5 hash: 3ce5469a7a34b52cc10fd3f17c29b3a5
humanhash: hotel-two-louisiana-india
File name:nsetldk.dll
Download: download sample
Signature Dridex
Create hunting rule
File size:645'120 bytes
First seen:2020-11-26 04:05:14 UTC
Last seen:2020-11-26 05:43:18 UTC
File type:DLL dll
MIME type:application/x-dosexec
imphash 8c547040bfa7b5342bc2768d5dc42f8f (1 x Dridex)
ssdeep 12288:wWgj44r+TR9BOlTxYprswC+x/c52TCEGlviDkjG4nTehyMYH:Be44iQlTxKp5TCEGlhFTehyMYH
Threatray 168 similar samples on MalwareBazaar
TLSH 85D4E002F792C0A1F56B0335447BC4E2877D7E11877889D772E62A1F7DA32E46538B8A
Reporter JAMESWT_WT
Tags:dll Dridex

Intelligence

File Origin
# of uploads :
2
# of downloads :
167
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
Sending a custom TCP request
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
64 / 100
Link:
https://www.joesandbox.com/analysis/547657
Signature
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
System process connects to network (likely due to code injection or exploit)
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/9f38af84820dc29e805029409bbb2a5765036775973e3898b6db1f66c1b47270/
Threat name:
Win32.Infostealer.Dridex
Create hunting rule
Status:
Malicious
First seen:
2020-11-26 02:24:50 UTC
File Type:
PE (Dll)
Extracted files:
1
AV detection:
24 of 29 (82.76%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=t44k7becbxbj5acqffajxozkk5sqgz3vs47drgfw3mpwnqnuojya._file
Verdict:
malicious
Label(s):
dridex
Create hunting rule
Similar samples:
174c621f41276dd1732bb57b4e44aa0c5476ee3bf890a3ba0e02f7565d283d9c
Dridex
24e9d45999add1dac491b4c3cfb55b77b95a46bc693eec9df56d6194b7fbe25e
Dridex
4ef049a69d2343a538b8563388f2a9f6838e8e864c6738b1e4934a4e377369a9
Dridex
52dc6da720ff69d8dea66a117fb1fd57e7db0366ec7f55b05cce18f6a3477cc8
Dridex
560478c5532f341407bed4a90de3f7a53bb36d500691f1f41e7d18a44f354f8a
Dridex
83c390d82e19beec14d007b7350f4296c23ce9b3d131a3670ebb7424ad917410
Dridex
8a0258361b87a73111afc4fb6f2cf121aa3a52122577a3692628e577ab202a34
Dridex
b354b40413ec755a51a63ab930860d9078d9ad157f1f18b0d0c441d73bf6691c
Dridex
df2ed991a6ab65f2bc05805376dcf34de7febc5c5d4b37d400546e4e01d90fc0
Dridex
ee397380005f89781c43853c6d2a8922d8570b43208b9f7162c6e4c5903e33b7
Dridex
+ 158 additional samples on MalwareBazaar
Result
Malware family:
dridex
Create hunting rule
Score:
  10/10
Tags:
family:dridex botnet loader
Link:
https://tria.ge/reports/201126-vwbe2np51s/
Behaviour
Suspicious use of WriteProcessMemory
Dridex Loader
Dridex
Malware Config
C2 Extraction:
194.225.58.216:443
178.254.40.132:691
216.172.165.70:3889
198.57.200.100:3786
Unpacked files
SH256 hash:
9f38af84820dc29e805029409bbb2a5765036775973e3898b6db1f66c1b47270
MD5 hash:
3ce5469a7a34b52cc10fd3f17c29b3a5
SHA1 hash:
d6b121e7a8ed0e94c2e89e33ea6828290f858e90
Link:
https://www.unpac.me/results/2ca7bfe6-53bb-43bd-9f4f-7e51895b3d54/
SH256 hash:
03b70ca8d46ac3429406fa773bbc37c3c78ed563241a74d8a88d6940c690b7d0
MD5 hash:
e16afdebf1fb4f74dc37cd47816a8339
SHA1 hash:
91b86316cba3f29d0489bed2dc7b7bc23917860e
Link:
https://www.unpac.me/results/2ca7bfe6-53bb-43bd-9f4f-7e51895b3d54/
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:win_dridex_loader_v2
Create hunting rule
Author:Johannes Bader @viql
Description:detects some Dridex loaders

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/105578/

Comments