MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ae348b3372c25ec4df962239f1dedc15f750d8021e12fcc8f918623b0af6fd75. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Dridex

Vendor detections: 7

Intelligence 7 IOCs YARA 2 File information Comments

SHA256 hash:	ae348b3372c25ec4df962239f1dedc15f750d8021e12fcc8f918623b0af6fd75
SHA3-384 hash:	dfd1e97b07cf75c8e9f83e977f12049364db1d293cbdbc52655841d26b9ede39ff63a710f767652de95cfd41c521dd6c
SHA1 hash:	b117adde9c307494d83f6e76dacefedee1f73380
MD5 hash:	f16549beb46741a7ab052173af4c620d
humanhash:	arizona-purple-finch-social
File name:	ae348b3372c25ec4df962239f1dedc15f750d8021e12fcc8f918623b0af6fd75
Download:	download sample
Signature	Dridex Create hunting rule
File size:	376'832 bytes
First seen:	2021-03-29 15:55:35 UTC
Last seen:	Never
File type:	dll
MIME type:	application/x-dosexec
imphash	10b339eba7ed6a12d0c67a18515a94ff (22 x Dridex)
ssdeep	6144:ebazNBbycfmKsyUlVHMdUFIk1KyHNwoAxpFp5xMBC1h:FzeTlVH/7HNep5WBUh
Threatray	671 similar samples on MalwareBazaar
TLSH	DB84D01367D15031E6721F3848B389518AFF7DD28A34C9AB22C9115E2B277D05E78F6B
Reporter	Cryptolaemus1
Tags:	10444 Dridex

Cryptolaemus1

Dridex 10444

Intelligence

File Origin

# of uploads :

# of downloads :

108

Origin country :

n/a

Vendor Threat Intelligence

Detection:

DridexLoader

Link:

https://www.capesandbox.com/analysis/127732/

Detection(s):

SecuriteInfo.com.Program.Win32.Wacapew.Cml.9091.1168.UNOFFICIAL

Result

Verdict:

Clean

Maliciousness:

Behaviour

Sending a UDP request

Sending a custom TCP request

Result

Verdict:

UNKNOWN

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/ae348b3372c25ec4df962239f1dedc15f750d8021e12fcc8f918623b0af6fd75/

Threat name:

Win32.Worm.Cridex

Status:

Malicious

First seen:

2021-03-29 15:56:09 UTC

AV detection:

12 of 28 (42.86%)

Threat level:

5/5

Verdict:

malicious

Label(s):

dridex

gozi

Result

Malware family:

dridex

Score:

10/10

Tags:

family:dridex botnet:10444 botnet loader

Link:

https://tria.ge/reports/210329-a3hs94vfp6/

Behaviour

Suspicious use of WriteProcessMemory

Dridex Loader

Dridex

Malware Config

C2 Extraction:

210.65.244.176:443
37.34.58.210:6601
77.220.64.141:5037

Unpacked files

SH256 hash:

ccfdc104d2208c399d304330a7745c0da50c67f966c87a15bc710082911d0e06

MD5 hash:

60ec3e1cdf5738f039445e44bfb0931e

SHA1 hash:

a2f57cb0dda1b44a10cc018ef5f73fb06730ca5e

Link:

https://www.unpac.me/results/41f5d094-fbe5-4513-af2f-ec553d813260/

SH256 hash:

ae348b3372c25ec4df962239f1dedc15f750d8021e12fcc8f918623b0af6fd75

MD5 hash:

f16549beb46741a7ab052173af4c620d

SHA1 hash:

b117adde9c307494d83f6e76dacefedee1f73380

Link:

https://www.unpac.me/results/41f5d094-fbe5-4513-af2f-ec553d813260/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/ae348b3372c25ec4df962239f1dedc15f750d8021e12fcc8f918623b0af6fd75

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.