MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e894ffbf3791bf04c075ca34a4b1be5c139a75bacced161a6d4592854b28ecb9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Dridex


Vendor detections: 8


Intelligence 8 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e894ffbf3791bf04c075ca34a4b1be5c139a75bacced161a6d4592854b28ecb9
SHA3-384 hash: 5d4f8258c93528fa8c132bcc39ec44af8b59f3482dea5d2821b88eeeba4708bc2ccbe0ecef1559da245c4f282e1e4948
SHA1 hash: 37c93c8c4e2553534447572232ada11afce1f0d7
MD5 hash: 490c4b411100a1a9a68fdc6715393711
humanhash: carolina-romeo-johnny-arkansas
File name:490c4b41_by_Libranalysis
Download: download sample
Signature Dridex
Create hunting rule
File size:165'888 bytes
First seen:2021-05-20 17:31:03 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash 987b9d7dc84d935c3675da82d40e06f2 (8'604 x Dridex, 2 x Gozi, 1 x Tofsee)
ssdeep 3072:4mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:hLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p
Threatray 18'756 similar samples on MalwareBazaar
TLSH E6F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1
Reporter Libranalysis
Tags:Dridex


Avatar
Libranalysis
Uploaded as part of the sample sharing project

Intelligence

File Origin
# of uploads :
1
# of downloads :
68
Origin country :
n/a
Vendor Threat Intelligence
Detection:
DridexLoader
Create hunting rule
Link:
https://www.capesandbox.com/analysis/160158/
Detection(s):
Win.Packed.Generickdz-9852495-0
Create hunting rule

Win.Packed.Generickdz-9857416-0
Create hunting rule

SecuriteInfo.com.W32.AIDetect.malware2.10053.10635.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e894ffbf3791bf04c075ca34a4b1be5c139a75bacced161a6d4592854b28ecb9/
Threat name:
Win32.Trojan.Drixed
Create hunting rule
Status:
Malicious
First seen:
2021-05-20 17:31:12 UTC
AV detection:
41 of 47 (87.23%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
dridex
Create hunting rule
Similar samples:
22cc6c61c0ec6a66da3e77f8a5bddb5896cef70b0af169309f3fe3931acc0b60
Dridex
231fb96295c92552741b79d20b9836d6467e6976eeeaa0df687f7ef2ee6107c2
Dridex
3071a830a68b46de711a0558ee681994496a0ae200401465c3333d61e2e82c93
Dridex
779ff56e8fa60d62441d45fd8bff26257e0b9653d0872b0f0bfc3b09edf0f089
Dridex
943d5676944f66d9be405fdff891663c545fa722071357ee16cc948633afdbfa
Dridex
9f00493416de6afc537e089aa426917ba9e8ccab19ade62930be2af28bb1ec11
Dridex
c3cafb845903cf0fa3ea61d628328e9f55b44b2100221883840ce24f939b6428
Dridex
d53c80732efeb27107a604d8eeb16cd6f1660faad7173dd5c92a9e1648e284c8
Dridex
e39b8a469dbe57f0200f1935afa31761ed6b36a07b80859da37364769f2e35f8
Dridex
eaf812facdbca820b2666cd57cb02680a3e7b88b66518fe2b7ea4d3a29c418e5
Dridex
+ 18'746 additional samples on MalwareBazaar
Result
Malware family:
dridex
Create hunting rule
Score:
  10/10
Tags:
family:dridex botnet:40112 botnet evasion loader trojan
Link:
https://tria.ge/reports/210520-899246bt7j/
Behaviour
Suspicious use of WriteProcessMemory
Checks whether UAC is enabled
Dridex Loader
Dridex
Malware Config
C2 Extraction:
107.172.227.10:443
172.93.133.123:2303
108.168.61.147:8172
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Dridex
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/e894ffbf3791bf04c075ca34a4b1be5c139a75bacced161a6d4592854b28ecb9

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/160158/

Comments