MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cc242ab99ab6100dcdc98f004f26041fdd5b67015630d73bff76b03a3d2d607f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Dridex


Vendor detections: 9


Intelligence 9 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: cc242ab99ab6100dcdc98f004f26041fdd5b67015630d73bff76b03a3d2d607f
SHA3-384 hash: 2ddf8d0586cb2c58d7d94cb8b3cf3adff93bca172001647b038ec44ca595a425a00ecd11357c84a5cc53448b3085b65c
SHA1 hash: c2c3eef61cd0750851b1113b7f5d657e9d7a5627
MD5 hash: 9d9c1d19818e75ccf8c9de90709f26ce
humanhash: florida-wolfram-jig-aspen
File name:SecuriteInfo.com.Generic.mg.9d9c1d19818e75cc.18979
Download: download sample
Signature Dridex
Create hunting rule
File size:734'208 bytes
First seen:2021-01-26 19:59:04 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash 911c48a3ecd47e32eb31f356aa37b0df (6 x Dridex)
ssdeep 12288:7SDs0Ljpezsf/Lrxn9AiQwvM8hZDgh6cVBsepVEsY7/ICmco0ADXEwRsZ:WDrszsHxfjv7Dg1Dc7/IxEwRs
Threatray 5 similar samples on MalwareBazaar
TLSH 7CF4E161BED4E479F72E22304C27DCB9026ABC0456BAFC6F31DE2D5F15A2262F016794
Reporter SecuriteInfoCom
Tags:Dridex

Intelligence

File Origin
# of uploads :
1
# of downloads :
184
Origin country :
n/a
Vendor Threat Intelligence
Detection:
DridexLoader
Create hunting rule
Link:
https://www.capesandbox.com/analysis/113992/
Detection(s):
SecuriteInfo.com.Generic.mg.9d9c1d19818e75cc.18979.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
Sending a custom TCP request
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
64 / 100
Link:
https://www.joesandbox.com/analysis/591210
Signature
Found malware configuration
Multi AV Scanner detection for submitted file
System process connects to network (likely due to code injection or exploit)
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/cc242ab99ab6100dcdc98f004f26041fdd5b67015630d73bff76b03a3d2d607f/
Threat name:
Win32.Infostealer.Dridex
Create hunting rule
Status:
Malicious
First seen:
2021-01-26 14:50:34 UTC
AV detection:
13 of 27 (48.15%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=zqscvom2wyia3tojr4ae6jqed7ovwzybkyynoo77o2ydupjnmb7q._file
Verdict:
unknown
Similar samples:
26bf46b79aeb7775dbf7ccef58f5becb631ac14591ec9e1cdad6962600db5bc6
Dridex
3492d7a110e1745ed6c308da51de7b141e800febd2f62cf8d2797bffa694665b
Dridex
81222472b041091fc7af2308fee853b197d8b6dd0010dada181c153998535dd0
Dridex
b6cf019dca618ebc676b84c40846e0a9a2050689b35845af2f12a93442fb25e8
Dridex
cfcc473a5f83f83517a1c4917dd2c330be6252bc95fcf176e9b783fb694f6f31
Dridex
Result
Malware family:
dridex
Create hunting rule
Score:
  10/10
Tags:
family:dridex botnet discovery evasion loader trojan
Link:
https://tria.ge/reports/210126-ghpv2lq58a/
Behaviour
Suspicious use of WriteProcessMemory
Checks installed software on the system
Checks whether UAC is enabled
Blocklisted process makes network request
Dridex Loader
Dridex
Malware Config
C2 Extraction:
97.107.127.161:443
45.33.94.33:5037
159.89.91.92:5037
158.69.118.130:1443
Unpacked files
SH256 hash:
0aa9cc43f4324dba76d9aceb23b09ece2d9f88e64c6e2eeaabb152580baf09df
MD5 hash:
3611974e3c36a1b153dfb8df917bdb82
SHA1 hash:
27de0ba6408468aeb7b348b728b14ccfe267795e
Link:
https://www.unpac.me/results/afa5e414-14fb-4f35-8396-e5c1e429c465/
SH256 hash:
cc242ab99ab6100dcdc98f004f26041fdd5b67015630d73bff76b03a3d2d607f
MD5 hash:
9d9c1d19818e75ccf8c9de90709f26ce
SHA1 hash:
c2c3eef61cd0750851b1113b7f5d657e9d7a5627
Link:
https://www.unpac.me/results/afa5e414-14fb-4f35-8396-e5c1e429c465/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Trojan
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/cc242ab99ab6100dcdc98f004f26041fdd5b67015630d73bff76b03a3d2d607f

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DridexLoader
Create hunting rule
Author:kevoreilly
Description:Dridex v4 dropper C2 parsing function
Rule name:win_dridex_loader_v2
Create hunting rule
Author:Johannes Bader @viql
Description:detects some Dridex loaders

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Dridex

DLL dll cc242ab99ab6100dcdc98f004f26041fdd5b67015630d73bff76b03a3d2d607f

(this sample)

Cape
Cape
https://www.capesandbox.com/analysis/113992/
  
URLhaus
https://urlhaus.abuse.ch/url/977526/
  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/977488/
  
URLhaus
https://urlhaus.abuse.ch/url/977866/
  
URLhaus
https://urlhaus.abuse.ch/url/977849/
  
URLhaus
https://urlhaus.abuse.ch/url/977875/
  
URLhaus
https://urlhaus.abuse.ch/url/977897/
  
URLhaus
https://urlhaus.abuse.ch/url/977862/
  
URLhaus
https://urlhaus.abuse.ch/url/979263/

Comments