MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b50d018c09a5cde299a89d3dfb1ab1be4ec629bae18770e71f1cff0a770393af. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Dridex


Vendor detections: 10


Intelligence 10 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b50d018c09a5cde299a89d3dfb1ab1be4ec629bae18770e71f1cff0a770393af
SHA3-384 hash: beaab482016ae7cb4b85312a55351e9a073672e2cf5179d9e3847e57eb77a24a41f3ab8701e852499d9fd551691fdea6
SHA1 hash: 7acc13ef618deb9d4ffacb9391b169cb5300a2d7
MD5 hash: cce748f9cc22a563010d24c6075f7b81
humanhash: queen-magazine-vegan-sad
File name:SecuriteInfo.com.ArtemisCCE748F9CC22.27685
Download: download sample
Signature Dridex
Create hunting rule
File size:583'680 bytes
First seen:2021-02-01 18:57:45 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash 992f83a6ac9ffc7fbfa3394931631eeb (11 x Dridex)
ssdeep 12288:nvp6YjOHcxdxZkDZRFwurWjOZhpoSrpodTilnUuRV:nvp7ycnbKJ3mduy
Threatray 401 similar samples on MalwareBazaar
TLSH 13C4D0B8794084A5CC91403CF42CEAA8986D7CE7DE10A15372FF3F5F3B39992C565A1A
Reporter SecuriteInfoCom
Tags:Dridex

Intelligence

File Origin
# of uploads :
1
# of downloads :
168
Origin country :
n/a
Vendor Threat Intelligence
Detection:
DridexLoader
Create hunting rule
Link:
https://www.capesandbox.com/analysis/115016/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
Sending a custom TCP request
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Unknown
Detection:
malicious
Classification:
n/a
Score:
56 / 100
Link:
https://www.joesandbox.com/analysis/595809
Signature
Found malware configuration
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 346943 Sample: SecuriteInfo.com.ArtemisCCE... Startdate: 01/02/2021 Architecture: WINDOWS Score: 56 10 Found malware configuration 2->10 12 Multi AV Scanner detection for submitted file 2->12 6 loaddll32.exe 1 2->6         started        process3 process4 8 rundll32.exe 6->8         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b50d018c09a5cde299a89d3dfb1ab1be4ec629bae18770e71f1cff0a770393af/
Threat name:
Win32.Infostealer.Dridex
Create hunting rule
Status:
Malicious
First seen:
2021-02-01 16:57:28 UTC
AV detection:
5 of 46 (10.87%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=wugqddajuxg6fgnitu67wgvrxzhmmkn24gdxbzy7dt7qu5ydsoxq._file
Verdict:
malicious
Label(s):
dridex
Create hunting rule
Similar samples:
0314272b35a3bd50abff3aedee1bb29145c24287801e3972c9b661e3d204a793
Dridex
26a659ec56c7bd7b83a2f968626c1524bda829e0fefff37ecf4c4fb55ad158e3
Dridex
5df344d59266e5fead564806443ad057ea530cf70ed181886d85edecc8109ea2
Dridex
64ebf44c68d5bb6163a3a6c3b4dd54cd60c910f03e73870ac7027ba5f24776ad
Dridex
7de08123f0b297781a5208f516fff7350f2c0797cb4eb75de8f00ec8d03d851e
Dridex
85e89192cb6620876fbd1737641340e1f5996dffd1f8f1793922121ba5c26a74
Dridex
867f3e4cb10d1456e17d0568db6f3c3931138a94677562b54d1697e561d6d753
Dridex
98f50988f5edbdb8a8b45a834f26c921d3076fd269e6d17de47a8c5eee76268b
Dridex
b86c5596a0e616d559c17a0df56a9faf93a36b87db4dc919181d3c8acdbaf137
Dridex
cd3ac30871e82aa47b16692c82cca169ffb5163545121b6aaa9d1b2e37f65bb4
Dridex
+ 391 additional samples on MalwareBazaar
Result
Malware family:
dridex
Create hunting rule
Score:
  10/10
Tags:
family:dridex botnet:10444 botnet discovery evasion loader trojan
Link:
https://tria.ge/reports/210201-n37qz59fa2/
Behaviour
Suspicious use of WriteProcessMemory
Checks installed software on the system
Checks whether UAC is enabled
Blocklisted process makes network request
Dridex Loader
Dridex
Malware Config
C2 Extraction:
77.220.64.131:443
5.196.204.251:5037
192.99.41.136:981
24.229.3.146:4664
Unpacked files
SH256 hash:
9a740e3a304424413bd8bbd12100567714f797deca85221be0f7ce13fee73b3c
MD5 hash:
3800840105940192b2ce901bb7e06b09
SHA1 hash:
6a095694a6e9ddbd402bc9436963f09084041240
Link:
https://www.unpac.me/results/7b73646f-2006-42e9-a80f-9baf05335a6b/
SH256 hash:
b50d018c09a5cde299a89d3dfb1ab1be4ec629bae18770e71f1cff0a770393af
MD5 hash:
cce748f9cc22a563010d24c6075f7b81
SHA1 hash:
7acc13ef618deb9d4ffacb9391b169cb5300a2d7
Link:
https://www.unpac.me/results/7b73646f-2006-42e9-a80f-9baf05335a6b/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Glupteba
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/b50d018c09a5cde299a89d3dfb1ab1be4ec629bae18770e71f1cff0a770393af

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DridexLoader
Create hunting rule
Author:kevoreilly
Description:Dridex v4 dropper C2 parsing function
Rule name:win_dridex_loader_v2
Create hunting rule
Author:Johannes Bader @viql
Description:detects some Dridex loaders

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Dridex

DLL dll b50d018c09a5cde299a89d3dfb1ab1be4ec629bae18770e71f1cff0a770393af

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/986289/
  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/986294/
  
URLhaus
https://urlhaus.abuse.ch/url/986629/
  
URLhaus
https://urlhaus.abuse.ch/url/986662/
Cape
Cape
https://www.capesandbox.com/analysis/115016/

Comments