MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 afa5aa95fb44edefde6e1e8ecbf28fbebf4b56c272e13bb42e49be640223e419. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Dridex

Vendor detections: 9

Intelligence 9 IOCs YARA 3 File information Comments

SHA256 hash:	afa5aa95fb44edefde6e1e8ecbf28fbebf4b56c272e13bb42e49be640223e419
SHA3-384 hash:	aa4533c620be05e9e8a5e3482398f8bba618d412a6684651c7b0404dbc14a81f6fd562b45a467f1e38e745a8e4b55eda
SHA1 hash:	a766c3252b1143a5b84cbca968d8a27b8183c67d
MD5 hash:	e50cf8edb8ca59b9a17153e759b49172
humanhash:	mexico-cola-london-idaho
File name:	afa5aa95fb44edefde6e1e8ecbf28fbebf4b56c272e13bb42e49be640223e419
Download:	download sample
Signature	Dridex Create hunting rule
File size:	872'448 bytes
First seen:	2020-11-13 15:40:04 UTC
Last seen:	2024-07-24 20:19:42 UTC
File type:	dll
MIME type:	application/x-dosexec
imphash	aa57c18adc6cb59473049b210c72cd9b (13 x Dridex)
ssdeep	12288:JCJEFR/VdYyHiE6RaFPNN+bBKIwhjZWYKteZm75n:JCqf/VvHiE/NMdAKQm75n
Threatray	11 similar samples on MalwareBazaar
TLSH	0705E07293F98336F5FBB1B0E5B80921BD1DF591FA7A810BD00AD9055830AE860B57B7
Reporter	seifreed
Tags:	Dridex

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Detection(s):

Win.Malware.Bankerx-9787378-0

Result

Verdict:

Malware

Maliciousness:

Behaviour

Launching a process

Searching for the window

Creating a window

Changing a file

Forced system process termination

DNS request

Sending a custom TCP request

Forced shutdown of a system process

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/afa5aa95fb44edefde6e1e8ecbf28fbebf4b56c272e13bb42e49be640223e419/

Threat name:

Win32.Trojan.Drixed

Status:

Malicious

First seen:

2020-11-13 15:43:58 UTC

AV detection:

24 of 29 (82.76%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=v6s2vfp3itw67xtod2hmx4upx27uwvwcolqtxnbojg7giard4qmq._file

Verdict:

malicious

Label(s):

dridex

emotet

Result

Malware family:

dridex

Score:

10/10

Tags:

family:dridex botnet evasion loader persistence trojan

Link:

https://tria.ge/reports/201113-xx31fq2wax/

Behaviour

Modifies registry class

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of WriteProcessMemory

Checks SCSI registry key(s)

Enumerates system info in registry

Modifies Control Panel

Suspicious use of SetWindowsHookEx

Checks whether UAC is enabled

Enumerates connected drives

Modifies Installed Components in the registry

Dridex Loader

Dridex

Unpacked files

SH256 hash:

afa5aa95fb44edefde6e1e8ecbf28fbebf4b56c272e13bb42e49be640223e419

MD5 hash:

e50cf8edb8ca59b9a17153e759b49172

SHA1 hash:

a766c3252b1143a5b84cbca968d8a27b8183c67d

Link:

https://www.unpac.me/results/1da1a859-9d74-4850-8eee-73f5e2e65759/

SH256 hash:

85e0b42bd051528a98e6dabeacc3d5fa5548dd621030e678936029dfc70f0962

MD5 hash:

bd6df3fb3a644b5ca2fb258c8ba3e413

SHA1 hash:

3c07f553b98f5a8c94d3989e127cd1f11be521f0

Detections:

win_dridex_auto

Link:

https://www.unpac.me/results/1da1a859-9d74-4850-8eee-73f5e2e65759/

SH256 hash:

c5280a45996dcb2228319d100e6795e37fdaa9df8d5477ef0260cc34563aaa3a

MD5 hash:

a2498204e373a28df38a02a5cfc01444

SHA1 hash:

9670e5e99e8e42ed5aea70c6f8be2baa911f9175

Detections:

win_dridex_auto

Link:

https://www.unpac.me/results/1da1a859-9d74-4850-8eee-73f5e2e65759/

Parent samples :

08ddbd69aa6a6e0050e1b64c12f2ad2c5af69eec990a65a2ec0284243fcebb1c
87c5cc0860b21c1567249afb612ac41f574253341a8dee8912c99f34ced42fe6
8fb0488353fe8e23fe41da04eaa0c59b639e41371d9bb2ee2c628d81c322a372
94f7f97d1a7011ca17a4c4b4e0c1420937d2ed2d9beb6037edf4526031f661dd
740d02850542d0d29d86d871b289334cdec55608a6d4f08210e0a04d664012b7
95b67300462efd53cc88c9fa6c2cf21e558b3a3a09917f90a8491b10f4fda652
afa5aa95fb44edefde6e1e8ecbf28fbebf4b56c272e13bb42e49be640223e419
d5ab7b804bcfcd8941f44abd300b0b5df18f3ececf91a0072aa45bb72064ab21
e94e13000b458fea9b3da107479516b9f568dfeed7010747d1ab36d2ee363286

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Kryptik

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/afa5aa95fb44edefde6e1e8ecbf28fbebf4b56c272e13bb42e49be640223e419

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	DridexV4 Create hunting rule
Author:	kevoreilly
Description:	Dridex v4 Payload

Rule name:	win_dridex_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	autogenerated rule brought to you by yara-signator

Rule name:	win_dridex_loader_v2 Create hunting rule
Author:	Johannes Bader @viql
Description:	detects some Dridex loaders

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Delivery method

Other

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample