MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ada6c8cea7615848b5f10965c20743bd9b0ba320c328368c90bb63a1ca0d3582. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Dridex

Vendor detections: 10

Intelligence 10 IOCs YARA 3 File information Comments

SHA256 hash:	ada6c8cea7615848b5f10965c20743bd9b0ba320c328368c90bb63a1ca0d3582
SHA3-384 hash:	55cee5e68c93d2b8d6d48fcf2e6494ef896f6bb48e3ef505d38201c5dde562cb3d9d46acbf9d02b4ece53e97a6b5c4f0
SHA1 hash:	2835e6dbdf4f877c40c7fa4297fbc433ab0caf0d
MD5 hash:	74d393fe61e9d43360b4bc397df52c98
humanhash:	tennessee-beer-fanta-network
File name:	74d393fe61e9d43360b4bc397df52c98.dll
Download:	download sample
Signature	Dridex Create hunting rule
File size:	188'416 bytes
First seen:	2021-03-19 14:21:06 UTC
Last seen:	Never
File type:	dll
MIME type:	application/x-dosexec
imphash	296c5ce0ec7abebda668048df2df9b05 (17 x Dridex)
ssdeep	3072:OZ/Aq5HJv6rBXHdH1iF3P74buGdSg4GeLfqMsnwXB:ObRQBXHtq3PUbt3te7Bsn
Threatray	441 similar samples on MalwareBazaar
TLSH	83048E2DE2EFD9A4F6F33630293642219F257C92DA7CDD1C9B08964E98F01E4C994736
Reporter	abuse_ch
Tags:	dll Dridex

Intelligence

File Origin

# of uploads :

# of downloads :

203

Origin country :

n/a

Vendor Threat Intelligence

Detection:

DridexV4

Link:

https://www.capesandbox.com/analysis/125662/

Detection(s):

Win.Malware.Generic-9835136-0

Win.Malware.Fdme-9835139-0

SecuriteInfo.com.W32.AIDetectGBM.malware.01.14420.10245.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Sending a UDP request

Malware family:

Dridex

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/30380385-5445-4487-b0c1-c5d226d3237d

Result

Threat name:

Dridex

Detection:

malicious

Classification:

troj.evad

Score:

92 / 100

Link:

https://www.joesandbox.com/analysis/646216

Signature

C2 URLs / IPs found in malware configuration

Found malware configuration

Machine Learning detection for sample

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

System process connects to network (likely due to code injection or exploit)

Tries to detect sandboxes / dynamic malware analysis system (file name check)

Yara detected Dridex unpacked file

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/ada6c8cea7615848b5f10965c20743bd9b0ba320c328368c90bb63a1ca0d3582/

Threat name:

Win32.Trojan.Drixed

Status:

Malicious

First seen:

2021-03-19 10:06:00 UTC

AV detection:

25 of 28 (89.29%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=vwtmrtvhmfmernprbfs4eb2dxwnqxizaymudndeqxnr2dsqngwba._file

Verdict:

unknown

Result

Malware family:

dridex

Score:

10/10

Tags:

family:dridex botnet:111 botnet discovery evasion loader trojan

Link:

https://tria.ge/reports/210319-xlq9q3j8ex/

Behaviour

Suspicious use of WriteProcessMemory

Checks installed software on the system

Checks whether UAC is enabled

Blocklisted process makes network request

Dridex Loader

Dridex

Malware Config

C2 Extraction:

162.13.114.59:443
70.39.99.196:8172
37.187.115.122:6601

Unpacked files

SH256 hash:

bd77a3982f14d0fd645e10d8a11648e1afeac817913babeb58f2d30aadbef303

MD5 hash:

6aede47849a6c4fd29762efdc333191f

SHA1 hash:

3b0483ba8be69e353bf1a4000fdb92906cf643dc

Detections:

win_dridex_auto

Link:

https://www.unpac.me/results/631e3b61-7464-46ef-982f-64e00bee3da3/

Parent samples :

cd7697dbe4ec3ecda59bcaf4a8d15de4cbb2cbed88b3b852fd73926cf040b68b
6b81a2465f8addb72bdf4c947638430d936223ef14c324c09a67ac42ac4250a8
0a082fbd636777d933a585cdbd687e550dcce3048c467e3ac0899dc9ee5a04d3
d3e4a34d13bbfccea5715e95b34c4b2a61b9c920752865add848cd43eac04869
00cbdefe7dda0c470d03e1d386acdef065ab738abe0641a42b1ad3d711940914
cdc6fdc6cfa18d26713eba66ebe9e3885bea2d8e48f049293706de870126743b
69270306507c02cbcfc8c8432e4cfbe1888c7b23decd2d659caf9375e153713a
a6c0c1e180453c757a95e0f6800cf35e80c31a1d277a0a021ff313bb6f23c952
eccd9e2d19947f414025ddca3f91581672443c8c71cf745178c52a168a8e79ae
c38acc9a928d97adfde547af10e092940c7d3226cf93f7de46689e8b78702b51
3f9e2f49df05fceef07d02f4fafbe13be1ccda9d6c1a1f6d2c696223aa74a8b7
c30b5746271fe4d4f3af7d6de38356a1da42c3117ad50cf1066631f6f91aa414
6bf9cd30ab801aa6794ba8736e9665d259e4d837a8c599b83c325cdbd50be5b5
ed4fe8fcd0bbc0a3def448a2e59b765136232a733d8d3b0d5388021a6e2cd117
ada6c8cea7615848b5f10965c20743bd9b0ba320c328368c90bb63a1ca0d3582
547e81ee477ae73f30b4435bfa093d48082a0edfa3186a0e4af2eeab60b8d8e0

SH256 hash:

9273dc068013358d1ba8dc79b98fa530dac45dec4a7a044409055a1bda3fc1d2

MD5 hash:

8959e9f40aca843122eda4efdad772e8

SHA1 hash:

1f99610ab30f8015b189c0d961c15823d47b0bc6

Link:

https://www.unpac.me/results/631e3b61-7464-46ef-982f-64e00bee3da3/

SH256 hash:

ada6c8cea7615848b5f10965c20743bd9b0ba320c328368c90bb63a1ca0d3582

MD5 hash:

74d393fe61e9d43360b4bc397df52c98

SHA1 hash:

2835e6dbdf4f877c40c7fa4297fbc433ab0caf0d

Link:

https://www.unpac.me/results/631e3b61-7464-46ef-982f-64e00bee3da3/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Dridex

Score:

0.80

Link:

https://yomi.yoroi.company/submissions/ada6c8cea7615848b5f10965c20743bd9b0ba320c328368c90bb63a1ca0d3582

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	DridexV4 Create hunting rule
Author:	kevoreilly
Description:	Dridex v4 Payload

Rule name:	MALWARE_Win_DLLLoader Create hunting rule
Author:	ditekSHen
Description:	Detects unknown DLL Loader

Rule name:	win_dridex_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	autogenerated rule brought to you by yara-signator