MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 dd6039f57c72056748007b0dd5070aa7deac990972d33e8a9d5118122e559590. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Dridex

Vendor detections: 10

Intelligence 10 IOCs YARA 2 File information Comments

SHA256 hash:	dd6039f57c72056748007b0dd5070aa7deac990972d33e8a9d5118122e559590
SHA3-384 hash:	5782e53cdb1f1c84179042ffe94180b8fb8c176862e850b086d28ac17d9ddc29475a820d88cafabb5ec05316f5fcd72b
SHA1 hash:	20ed16a3835e40c32ca7a78982ad6b7309bc8af7
MD5 hash:	2999166f65ee9217b7fbf7f35637e9dd
humanhash:	butter-failed-winter-red
File name:	oghmx5.rar.dll
Download:	download sample
Signature	Dridex Create hunting rule
File size:	576'000 bytes
First seen:	2021-02-01 11:49:33 UTC
Last seen:	2021-02-01 14:17:49 UTC
File type:	dll
MIME type:	application/x-dosexec
imphash	9f155d069630db0dd20e2b708dcbe65f (9 x Dridex)
ssdeep	6144:Dd9y7D5S9oY/fWpJwpcroS7G4F735egYHknym3l/ooV+bLUATfFezFbaYMzseZxu:W2fkRG4535RxJl/ovfUdFJMQ21W16d
Threatray	385 similar samples on MalwareBazaar
TLSH	BFC4D1B9794041A5CC41543CF43CF6A888AE7CB78E14A15372FF3E1F7B3A9A2C515A1A
Reporter	JAMESWT_WT
Tags:	dll Dridex

Intelligence

File Origin

# of uploads :

# of downloads :

137

Origin country :

n/a

Vendor Threat Intelligence

Detection:

DridexLoader

Link:

https://www.capesandbox.com/analysis/114481/

Result

Verdict:

Malware

Maliciousness:

Behaviour

Sending a UDP request

Sending a custom TCP request

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Result

Threat name:

Unknown

Detection:

malicious

Classification:

n/a

Score:

52 / 100

Link:

https://www.joesandbox.com/analysis/595295

Signature

Machine Learning detection for sample

Multi AV Scanner detection for submitted file

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/dd6039f57c72056748007b0dd5070aa7deac990972d33e8a9d5118122e559590/

Threat name:

Win32.Infostealer.Dridex

Status:

Malicious

First seen:

2021-02-01 11:50:07 UTC

File Type:

PE (Dll)

Extracted files:

AV detection:

7 of 29 (24.14%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=3vqdt5l4oicwosaapmg5kbyku7pkzgijoljt5cu5kembelsvswia._file

Verdict:

malicious

Label(s):

dridex

Result

Malware family:

dridex

Score:

10/10

Tags:

family:dridex botnet:10444 botnet discovery evasion loader trojan

Link:

https://tria.ge/reports/210201-5vnketf3zx/

Behaviour

Suspicious use of WriteProcessMemory

Checks installed software on the system

Checks whether UAC is enabled

Blocklisted process makes network request

Dridex Loader

Dridex

Malware Config

C2 Extraction:

77.220.64.131:443
5.196.204.251:5037
192.99.41.136:981
24.229.3.146:4664

Unpacked files

SH256 hash:

1da5a0bd15015eb61f48ad7ce1b3931f89c7384dc136e4db188232d15e3eb5a7

MD5 hash:

c3ba6196b84a44fe79c70550dda67588

SHA1 hash:

cc3880604674ee159edd52564bceb895207349d1

Link:

https://www.unpac.me/results/1e3c2718-4eff-492b-b7fe-be259255765e/

SH256 hash:

dd6039f57c72056748007b0dd5070aa7deac990972d33e8a9d5118122e559590

MD5 hash:

2999166f65ee9217b7fbf7f35637e9dd

SHA1 hash:

20ed16a3835e40c32ca7a78982ad6b7309bc8af7

Link:

https://www.unpac.me/results/1e3c2718-4eff-492b-b7fe-be259255765e/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/dd6039f57c72056748007b0dd5070aa7deac990972d33e8a9d5118122e559590

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.