MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 b2b398374fed09425fb6fe6986b77977b221a9160f3dacc5f5cb01c99643b8d5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Dridex
Vendor detections: 10
| SHA256 hash: | b2b398374fed09425fb6fe6986b77977b221a9160f3dacc5f5cb01c99643b8d5 |
|---|---|
| SHA3-384 hash: | a0e47ce82273d08b3b9c22581d421ca1d197c98edc6beab9f27bcd5a3a1e14214a427cfd5406ec83d13835fc92778c31 |
| SHA1 hash: | 377f22ec99f67ca380ca61f6c5732fb2b8e426b2 |
| MD5 hash: | a6fa2e86006a76b8f28ec150a0ad761c |
| humanhash: | five-failed-lemon-foxtrot |
| File name: | SecuriteInfo.com.Suspicious.Win32.Save.a.20268.31276 |
| Download: | download sample |
| Signature | Dridex |
| File size: | 786'432 bytes |
| First seen: | 2021-11-24 18:52:06 UTC |
| Last seen: | Never |
| File type: |  dll |
| MIME type: | application/x-dosexec |
| imphash | aad41bc76bfe216cfc48b81f52e4aae9 (2 x Dridex) |
| ssdeep | 6144:xIiOww28O6OKaSYqiI4wgYMsXvKVE4C8WDOrIyiafz0AyeCEkTjFtRg2rQlftW9Q:WXyVrpWOrIRvBFw28RtGkl3 |
| Threatray | 4'994 similar samples on MalwareBazaar |
| TLSH | T1BEF49E3375711882E55213F9C8E53372DF17EB8588D01CD90F98BA9608BADF9A8C9DE1 |
| Reporter |  SecuriteInfoCom |
| Tags: | dll Dridex |
Intelligence
File Origin
# of uploads :
1
# of downloads :
164
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Result
Verdict:
Clean
Maliciousness:
Behaviour
Searching for the window
Сreating synchronization primitives
DNS request
Sending a custom TCP request
Verdict:
Suspicious
Threat level:
5/10
Confidence:
100%
Tags:
packed
Malware family:
Dridex
Verdict:
Malicious
Result
Threat name:
Dridex
Detection:
malicious
Classification:
bank.troj.evad
Score:
84 / 100
Signature
C2 URLs / IPs found in malware configuration
Detected Dridex e-Banking trojan
Found malware configuration
Multi AV Scanner detection for submitted file
System process connects to network (likely due to code injection or exploit)
Yara detected Dridex unpacked file
Behaviour
Behavior Graph:
Threat name:
Win32.Trojan.Drixed
Status:
Malicious
First seen:
2021-11-24 15:18:40 UTC
File Type:
PE (Dll)
AV detection:
20 of 28 (71.43%)
Threat level:
5/5
Detection(s):
Malicious file
Verdict:
malicious
Label(s):
dridex
Similar samples:
+ 4'984 additional samples on MalwareBazaar
Result
Malware family:
dridex
Score:
10/10
Tags:
family:dridex botnet:22201 botnet discovery evasion trojan
Behaviour
Suspicious use of WriteProcessMemory
Checks installed software on the system
Checks whether UAC is enabled
Blocklisted process makes network request
Dridex
Malware Config
C2 Extraction:
107.170.4.227:443
178.128.222.53:8116
185.148.168.15:4664
64.251.25.156:6602
178.128.222.53:8116
185.148.168.15:4664
64.251.25.156:6602
Unpacked files
SH256 hash:
d9d64b528239eba399436bc1234145acb3ab281b5e8f54e31a15a47b5226ca50
MD5 hash:
d6e0cd557963fbf8ee23513849132976
SHA1 hash:
652f0ba8c10e481284f667ea2e6f174238c5e921
Detections:
win_dridex_auto
SH256 hash:
b610209072439d7ba3bb76bf5e60d153458e1e3f611b1f7b43f75d3194421d2e
MD5 hash:
321d76128a772fbe04fd718df77bccfd
SHA1 hash:
1b37ea4cce1ef9338a256512994dfd934d95535c
SH256 hash:
b2b398374fed09425fb6fe6986b77977b221a9160f3dacc5f5cb01c99643b8d5
MD5 hash:
a6fa2e86006a76b8f28ec150a0ad761c
SHA1 hash:
377f22ec99f67ca380ca61f6c5732fb2b8e426b2
Malware family:
Dridex
Verdict:
Malicious
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.14
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | DridexLoader |
|---|---|
| Author: | kevoreilly |
| Description: | Dridex v4 dropper C2 parsing function |
| Rule name: | DridexV4 |
|---|---|
| Author: | kevoreilly |
| Description: | Dridex v4 Payload |
| Rule name: | dridex_loader |
|---|---|
| Author: | kevoreilly |
| Description: | Dridex Loader |
| Rule name: | MALWARE_Win_DLLLoader |
|---|---|
| Author: | ditekSHen |
| Description: | Detects unknown DLL Loader |
| Rule name: | win_dridex_auto |
|---|---|
| Author: | Felix Bilstein - yara-signator at cocacoding dot com |
| Description: | Detects win.dridex. |
| Rule name: | win_dridex_loader_v2 |
|---|---|
| Author: | Johannes Bader @viql |
| Description: | detects some Dridex loaders |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Web download
Delivery method
Distributed via web download
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.