MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e76265db953d7d12454e40051feadafab1af934761bd73f02b5d634679d443d1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Dridex

Vendor detections: 6

Intelligence 6 IOCs YARA 1 File information Comments

SHA256 hash:	e76265db953d7d12454e40051feadafab1af934761bd73f02b5d634679d443d1
SHA3-384 hash:	947c38f6d6ebc3681259655aee889a525201305661e3c777cd805d77ef611c34f626aee1b3efe4d7b14bec29777cbfec
SHA1 hash:	069f6b896864d59173ecdba22f8a74badafcfd4b
MD5 hash:	ad06d7c9fd0e59364cdf19a41831c564
humanhash:	yankee-nine-muppet-juliet
File name:	SecuriteInfo.com.Generic.mg.ad06d7c9fd0e5936.26135
Download:	download sample
Signature	Dridex Create hunting rule
File size:	512'000 bytes
First seen:	2020-12-07 20:38:24 UTC
Last seen:	Never
File type:	dll
MIME type:	application/x-dosexec
imphash	e5cdacf32e37bc06f2f78fda932b0544 (1 x Dridex)
ssdeep	12288:vm40DrN+2shkHczDkBSN+Wv1vGaa3tCT0PjVj7x:vm40vmk8zDQ8Z1S3tCAPjV/
TLSH	2AB4C062BDA0E439EB6D13344C1BED7802A7BC0197A9FC5F32EE1D5B51E2252B903394
Reporter	SecuriteInfoCom
Tags:	Dridex

Intelligence

File Origin

# of uploads :

# of downloads :

173

Origin country :

n/a

Vendor Threat Intelligence

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/107117/

Detection(s):

SecuriteInfo.com.Generic.mg.ad06d7c9fd0e5936.26135.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Sending a UDP request

Sending a custom TCP request

Result

Verdict:

UNKNOWN

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Result

Threat name:

Unknown

Detection:

malicious

Classification:

n/a

Score:

48 / 100

Link:

https://www.joesandbox.com/analysis/557352

Signature

Multi AV Scanner detection for submitted file

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/e76265db953d7d12454e40051feadafab1af934761bd73f02b5d634679d443d1/

Threat name:

Win32.Infostealer.Dridex

Status:

Malicious

First seen:

2020-12-07 17:46:39 UTC

AV detection:

20 of 29 (68.97%)

Threat level:

5/5

Result

Malware family:

dridex

Score:

10/10

Tags:

family:dridex botnet discovery evasion loader trojan

Link:

https://tria.ge/reports/201207-ntyx945zra/

Behaviour

Suspicious use of WriteProcessMemory

Checks installed software on the system

Checks whether UAC is enabled

Blocklisted process makes network request

Dridex Loader

Dridex

Malware Config

C2 Extraction:

104.131.164.93:443
46.101.90.205:4643
27.254.174.84:4443
92.94.251.127:3786

Unpacked files

SH256 hash:

e76265db953d7d12454e40051feadafab1af934761bd73f02b5d634679d443d1

MD5 hash:

ad06d7c9fd0e59364cdf19a41831c564

SHA1 hash:

069f6b896864d59173ecdba22f8a74badafcfd4b

Link:

https://www.unpac.me/results/80822162-6048-40b0-ac9e-6c0ff56ef258/

SH256 hash:

79677819fd41e8966029c2b4ed66a644e5ebd455c6492b41bb59dcf13d5dd784

MD5 hash:

73738e0099f510e71c1e2c20d9bac2f1

SHA1 hash:

9aea7a04ed13a1e9f8b12a00ac84c1868952d7e4

Link:

https://www.unpac.me/results/80822162-6048-40b0-ac9e-6c0ff56ef258/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Trojan

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/e76265db953d7d12454e40051feadafab1af934761bd73f02b5d634679d443d1

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.