MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cdf711e624173c21c77983e25b57e8422643b890c9c4b067e09e9e69a03d0a3d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Dridex

Vendor detections: 5

Intelligence 5 IOCs YARA 1 File information Comments

SHA256 hash:	cdf711e624173c21c77983e25b57e8422643b890c9c4b067e09e9e69a03d0a3d
SHA3-384 hash:	4784c24f58649a12f3896a818ee5504c492b9cf88d3f4866055f96e3de71c9ade4535e60fdd0b404dd7135a80f27fc1e
SHA1 hash:	39a67f2d4227dd490b5bcb27ce491d417a78928f
MD5 hash:	443a9666472dc6997307ff8108b60554
humanhash:	twenty-lima-nebraska-cat
File name:	u6hgcyzip
Download:	download sample
Signature	Dridex Create hunting rule
File size:	1'670'656 bytes
First seen:	2020-10-28 13:42:05 UTC
Last seen:	2020-10-28 13:51:11 UTC
File type:	dll
MIME type:	application/x-dosexec
imphash	5e7e438e9d01da267c979b9379323794 (1 x Dridex)
ssdeep	24576:DXxU1Db0+xzg2oI8r/5QBd+XodsMPt0EqZDA4MSEcD+QKT:LcDYWg2oI8r/6d+DMPu96SZ+QKT
TLSH	A075F1227792D079C1268139CEC9E8FD8765BD1ADF2419C730C47F6F3A369510B3AA1A
Reporter	JAMESWT_WT
Tags:	Dridex

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/80488/

Result

Verdict:

Clean

Maliciousness:

Behaviour

Sending a UDP request

Result

Threat name:

Unknown

Detection:

malicious

Classification:

evad

Score:

64 / 100

Link:

https://www.joesandbox.com/analysis/515082

Signature

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

System process connects to network (likely due to code injection or exploit)

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/cdf711e624173c21c77983e25b57e8422643b890c9c4b067e09e9e69a03d0a3d/

Threat name:

Win32.Infostealer.Dridex

Status:

Malicious

First seen:

2020-10-28 12:01:50 UTC

File Type:

PE (Dll)

AV detection:

22 of 29 (75.86%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=zx3rdzrec46cdr3zqprfwv7iiitehoeqzhclaz7at2pgtib5bi6q._file

Result

Malware family:

dridex

Score:

10/10

Tags:

family:dridex botnet discovery evasion loader trojan

Link:

https://tria.ge/reports/201028-d6anbsze7n/

Behaviour

Suspicious use of WriteProcessMemory

Checks installed software on the system

Checks whether UAC is enabled

Blacklisted process makes network request

Dridex Loader

Dridex

Malware Config

C2 Extraction:

77.220.64.55:443
51.254.163.104:1688
165.22.65.75:3388
103.41.110.115:33443

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.