MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e26c7e7c111e41d766ab313e1c4c0f17cbc9710aee23248b017735caf97f2a0e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Dridex

Vendor detections: 9

Intelligence 9 IOCs YARA 6 File information Comments 1

SHA256 hash:	e26c7e7c111e41d766ab313e1c4c0f17cbc9710aee23248b017735caf97f2a0e
SHA3-384 hash:	e4c581ee9733f0ea6e148b7760c1e272e4fa3aaa9aac708eabe272b6c368d0061eac3cfd8aa8d36e9ab2f6723a776430
SHA1 hash:	be2b540f68f41a7a05e7d68c52712347f979b706
MD5 hash:	45d9d9c13a4b2f77a5635a64cd58bd03
humanhash:	beryllium-mike-bulldog-comet
File name:	45d9d9c13a4b2f77a5635a64cd58bd03
Download:	download sample
Signature	Dridex Create hunting rule
File size:	179'712 bytes
First seen:	2021-07-21 19:57:43 UTC
Last seen:	2021-07-21 21:40:29 UTC
File type:	dll
MIME type:	application/x-dosexec
imphash	44b0dcdef59120fe964e77dc09a5f1e7 (8 x Dridex)
ssdeep	3072:Zb35eJIBwzBgXbJ26juQdZHT5K4PrsF2ATdwNBJUiG7NNNNNNNNNNNNNNNuetbX4:ZNe2Gzm1dZtK4Puhha87NNNNNNNNNNNI
Threatray	4'615 similar samples on MalwareBazaar
TLSH	T1A804C0C9D2FA1786D4B1967D1D84531BA4183C09CC35ED96C980CF5EEA3B204EB3675B
Reporter	zbetcheckin
Tags:	32 dll Dridex exe

Intelligence

File Origin

# of uploads :

# of downloads :

135

Origin country :

n/a

Vendor Threat Intelligence

Detection:

DridexLoader

Link:

https://www.capesandbox.com/analysis/173122/

Detection(s):

SecuriteInfo.com.W32.AIDetect.malware1.5878.29061.UNOFFICIAL

Result

Verdict:

UNKNOWN

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Generic Malware

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/cf7b2b4f-c22e-46ab-8ab8-b32dce0abca3

Result

Threat name:

Dridex

Detection:

malicious

Classification:

troj

Score:

76 / 100

Link:

https://www.joesandbox.com/analysis/819743

Signature

C2 URLs / IPs found in malware configuration

Found malware configuration

Found PHP interpreter

Machine Learning detection for sample

Multi AV Scanner detection for submitted file

Yara detected Dridex unpacked file

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/e26c7e7c111e41d766ab313e1c4c0f17cbc9710aee23248b017735caf97f2a0e/

Threat name:

Win32.Trojan.GenericML

Status:

Malicious

First seen:

2021-07-21 19:44:29 UTC

AV detection:

10 of 27 (37.04%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=4jwh47ardza5ozvlge7bytapc7f4s4ik5yrsjcybo424v6l7fiha._file

Verdict:

malicious

Label(s):

doppeldridex

dridex

Result

Malware family:

dridex

Score:

10/10

Tags:

family:dridex botnet:22201 botnet loader

Link:

https://tria.ge/reports/210721-2f6pavapp2/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Program crash

Dridex Loader

Dridex

Malware Config

C2 Extraction:

178.238.236.59:443
104.245.52.73:5007
81.0.236.93:13786

Unpacked files

SH256 hash:

7795ce32311a61dc7425263f9dda2905aa6c03928fa952c1d5e2394cbeecf89e

MD5 hash:

fd35a1a9b5eaa422e8a3d34d0fc88af2

SHA1 hash:

6683a32df8a8e53b0455da429b1f0e9458d69016

Detections:

win_doppeldridex_auto

Link:

https://www.unpac.me/results/8925323a-ee53-4ac4-a230-233bacd84df2/

Parent samples :

a51b5bab04a5b0f549dd27851e83550a47cd38abd109ee24bc1d96aae089d25c
e26c7e7c111e41d766ab313e1c4c0f17cbc9710aee23248b017735caf97f2a0e
55bc0af1e99d0310ea3e8668aba02e4d3aa3c800b85fe304a6377968a4668cc1
1a560adb810b924e65f91e34664166be2c2adac10f7f28c075d902e4adb1112c
7a64e750e4ffda0b1731bf0449d335d2e23d0b76bb3d66830f5fb740fdc0ca4a

SH256 hash:

f6d8e1d7a66108bd242806ff3f7290d77cb1d9dfceee2ee31175d4a06f2179df

MD5 hash:

52fea11969ab2313f0e61c8692c243d0

SHA1 hash:

12432cff901cb04c1eb65bb736188271b5e6ee29

Detections:

win_dridex_auto

Link:

https://www.unpac.me/results/8925323a-ee53-4ac4-a230-233bacd84df2/

Parent samples :

f2c2d92afa0f167bd54c763fc8fc3377bb6b9f1105b4bd0760c5a19018c41c3c
6e1a19c1ead7999ac95c9a6ec469cedfdda7b513dee65cf6c3c7ebf9385eaffc
a51b5bab04a5b0f549dd27851e83550a47cd38abd109ee24bc1d96aae089d25c
80012d65f11c6481e6e98a03016f5a69ed2ae210af24d810b7ce562318a9b116
e26c7e7c111e41d766ab313e1c4c0f17cbc9710aee23248b017735caf97f2a0e
55bc0af1e99d0310ea3e8668aba02e4d3aa3c800b85fe304a6377968a4668cc1
1a560adb810b924e65f91e34664166be2c2adac10f7f28c075d902e4adb1112c
7a64e750e4ffda0b1731bf0449d335d2e23d0b76bb3d66830f5fb740fdc0ca4a

SH256 hash:

e26c7e7c111e41d766ab313e1c4c0f17cbc9710aee23248b017735caf97f2a0e

MD5 hash:

45d9d9c13a4b2f77a5635a64cd58bd03

SHA1 hash:

be2b540f68f41a7a05e7d68c52712347f979b706

Link:

https://www.unpac.me/results/8925323a-ee53-4ac4-a230-233bacd84df2/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.14

Link:

https://yomi.yoroi.company/submissions/e26c7e7c111e41d766ab313e1c4c0f17cbc9710aee23248b017735caf97f2a0e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	DridexLoader Create hunting rule
Author:	kevoreilly
Description:	Dridex v4 dropper C2 parsing function

Rule name:	DridexV4 Create hunting rule
Author:	kevoreilly
Description:	Dridex v4 Payload

Rule name:	INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFuture Create hunting rule
Author:	ditekSHen
Description:	Detect executables with stomped PE compilation timestamp that is greater than local current time