MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e0a50e73c6801e2374bc0aa3a16140ade32bf777a15377c5e84e75079fb7f70a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Dridex

Vendor detections: 7

Intelligence 7 IOCs YARA 2 File information Comments

SHA256 hash:	e0a50e73c6801e2374bc0aa3a16140ade32bf777a15377c5e84e75079fb7f70a
SHA3-384 hash:	2db00a4d1421b2a31feb09ab31066611e5d82b73f708f0b77773915bac00fc1c12e2aa9c4a9dc514638d27cb80758da4
SHA1 hash:	a5290d5c2fc27fd8c55e5e91c31fac4881f3ba3c
MD5 hash:	b69ecc0e9270bab34465b4eda916b356
humanhash:	fifteen-four-arizona-alabama
File name:	e0a50e73c6801e2374bc0aa3a16140ade32bf777a15377c5e84e75079fb7f70a
Download:	download sample
Signature	Dridex Create hunting rule
File size:	577'536 bytes
First seen:	2021-03-01 14:12:17 UTC
Last seen:	2021-03-01 15:37:37 UTC
File type:	dll
MIME type:	application/x-dosexec
imphash	83861fb77ed2188363c53e94249a006f (6 x Dridex)
ssdeep	12288:9ieGWYv9l8BOdbZ5ECQ+ElFKxDvaqhRyALFj:zu9OBOpZ5cluvay
Threatray	489 similar samples on MalwareBazaar
TLSH	B7C48C04B665C076F47690B9DC62C7FDA9993C61CF2884D7B6D22F1F713E5A0A932223
Reporter	Cryptolaemus1
Tags:	10444 Dridex

Cryptolaemus1

Dridex 10444

Intelligence

File Origin

# of uploads :

# of downloads :

124

Origin country :

n/a

Vendor Threat Intelligence

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/120314/

Detection(s):

SecuriteInfo.com.ML.PE-A.28078.22494.UNOFFICIAL

Result

Verdict:

Clean

Maliciousness:

Behaviour

Sending a UDP request

Sending a custom TCP request

Result

Verdict:

UNKNOWN

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/e0a50e73c6801e2374bc0aa3a16140ade32bf777a15377c5e84e75079fb7f70a/

Threat name:

Win32.Infostealer.Dridex

Status:

Malicious

First seen:

2021-03-01 14:13:05 UTC

AV detection:

14 of 29 (48.28%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=4csq446gqapcg5f4bkr2cykavxrsx53xufjxprpijz2qph5x64fa._file

Verdict:

malicious

Label(s):

dridex

Result

Malware family:

dridex

Score:

10/10

Tags:

family:dridex botnet:10444 botnet loader

Link:

https://tria.ge/reports/210301-dlbvmzfhpx/

Behaviour

Suspicious use of WriteProcessMemory

Dridex Loader

Dridex

Malware Config

C2 Extraction:

77.220.64.146:443
85.25.134.43:8172
213.208.134.178:6516

Unpacked files

SH256 hash:

b78f65e3c85fab4991587a566b75ca9a13fed183af6758160e7e9f1e802e6613

MD5 hash:

49dfc3cba167c382004bcdf644780c36

SHA1 hash:

669e1a3391766bd154810556f544d72df46b2421

Link:

https://www.unpac.me/results/8df616bc-831e-406f-b301-4ccf11156519/

SH256 hash:

e0a50e73c6801e2374bc0aa3a16140ade32bf777a15377c5e84e75079fb7f70a

MD5 hash:

b69ecc0e9270bab34465b4eda916b356

SHA1 hash:

a5290d5c2fc27fd8c55e5e91c31fac4881f3ba3c

Link:

https://www.unpac.me/results/8df616bc-831e-406f-b301-4ccf11156519/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/e0a50e73c6801e2374bc0aa3a16140ade32bf777a15377c5e84e75079fb7f70a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.