MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 dace6bde47bead3ca8032c326ac2abf2ec9c2e98474258cfcec6b92f6fb22a79. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Dridex

Vendor detections: 8

Intelligence 8 IOCs YARA 2 File information Comments

SHA256 hash:	dace6bde47bead3ca8032c326ac2abf2ec9c2e98474258cfcec6b92f6fb22a79
SHA3-384 hash:	decc83930eb06c5a1d382fb0362279f05c12a7bff739009b495a18b50d545fe3adb275708c044d5c53971a140253d45f
SHA1 hash:	0b8f15c9a156d3089ff1ab812c2c4cb1c8d27e94
MD5 hash:	9d6f5d62ea102da976947af973c89da9
humanhash:	sixteen-fillet-glucose-bacon
File name:	SecuriteInfo.com.Generic.mg.9d6f5d62ea102da9.2137
Download:	download sample
Signature	Dridex Create hunting rule
File size:	511'488 bytes
First seen:	2021-01-27 14:18:58 UTC
Last seen:	Never
File type:	dll
MIME type:	application/x-dosexec
imphash	d934d4b4dcd8b3eafa45df91d3974d8c (22 x Dridex)
ssdeep	12288:gHJKHBtI0YhffKYr27MLnP6jVoNPBwO6AKUr7SBX:gqrYhnDr2oPCV8SZB
Threatray	371 similar samples on MalwareBazaar
TLSH	53B49E23F994A425F32913304C67E4A246F9BD40966DED5B31DF3D1F38A2372B16A389
Reporter	SecuriteInfoCom
Tags:	Dridex

Intelligence

File Origin

# of uploads :

# of downloads :

156

Origin country :

n/a

Vendor Threat Intelligence

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/114084/

Detection(s):

SecuriteInfo.com.Generic.mg.9d6f5d62ea102da9.2137.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Sending a UDP request

Sending a custom TCP request

Result

Verdict:

UNKNOWN

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Result

Threat name:

Dridex

Detection:

malicious

Classification:

bank.evad

Score:

72 / 100

Link:

https://www.joesandbox.com/analysis/591881

Signature

Detected Dridex e-Banking trojan

Found malware configuration

Multi AV Scanner detection for submitted file

System process connects to network (likely due to code injection or exploit)

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/dace6bde47bead3ca8032c326ac2abf2ec9c2e98474258cfcec6b92f6fb22a79/

Threat name:

Win32.Infostealer.Dridex

Status:

Malicious

First seen:

2021-01-27 12:11:55 UTC

File Type:

PE (Dll)

Extracted files:

AV detection:

19 of 28 (67.86%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=3lhgxxshx2wtzkadfqzgvqvl6lwjyluyi5bfrt6oy24s635sfj4q._file

Verdict:

malicious

Label(s):

dridex

Result

Malware family:

dridex

Score:

10/10

Tags:

family:dridex botnet loader

Link:

https://tria.ge/reports/210127-z11e35hq4e/

Behaviour

Suspicious use of WriteProcessMemory

Dridex Loader

Dridex

Malware Config

C2 Extraction:

193.90.12.20:443
185.181.9.76:5037
175.207.13.56:5353
212.129.24.84:5037

Unpacked files

SH256 hash:

0f987c306b5056823b83236a153fc523fe1121e5749fefd2a9be36b0c3a42b4f

MD5 hash:

93511d9a736af5f8caf47edfda703a66

SHA1 hash:

ad274f0a9ab98ea5261e17b5a02dc91b825e1ffd

Link:

https://www.unpac.me/results/8a59af2b-bd0f-4c2c-9d78-59a3fc927b14/

SH256 hash:

dace6bde47bead3ca8032c326ac2abf2ec9c2e98474258cfcec6b92f6fb22a79

MD5 hash:

9d6f5d62ea102da976947af973c89da9

SHA1 hash:

0b8f15c9a156d3089ff1ab812c2c4cb1c8d27e94

Link:

https://www.unpac.me/results/8a59af2b-bd0f-4c2c-9d78-59a3fc927b14/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Trojan

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/dace6bde47bead3ca8032c326ac2abf2ec9c2e98474258cfcec6b92f6fb22a79

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.