MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e968a974cc98a567ecb3af6cb4b4f4d70151ac796c75bafdfad291203adc07ea. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Dridex

Vendor detections: 8

Intelligence 8 IOCs YARA 2 File information Comments

SHA256 hash:	e968a974cc98a567ecb3af6cb4b4f4d70151ac796c75bafdfad291203adc07ea
SHA3-384 hash:	c6ec5ac573cd6859f4d0a5ffd4de1ebd045095309cd6b4316367b83e3c42bb57b43e57ad57d13a56b56c41348b42c374
SHA1 hash:	240fac3efd7a453a7cdfefbbf41fb82316433946
MD5 hash:	145493e8315d2defee67560498664e43
humanhash:	skylark-salami-tennessee-montana
File name:	e968a974cc98a567ecb3af6cb4b4f4d70151ac796c75bafdfad291203adc07ea
Download:	download sample
Signature	Dridex Create hunting rule
File size:	578'048 bytes
First seen:	2021-03-30 07:14:41 UTC
Last seen:	2021-03-30 08:00:47 UTC
File type:	dll
MIME type:	application/x-dosexec
imphash	5cb457ca82de30b44453a66db17d2e56 (14 x Dridex)
ssdeep	6144:MGiMOQpsduhD3AZHC/uNbExd+4fuwf1b0717WLmw6Xg6DqaIDnnlvghs5la:xVhDQZHC/uNY1/fRm8LYQOQlYul
Threatray	709 similar samples on MalwareBazaar
TLSH	CAC4BF5397EA5421F6736F3908B316028AEBBEE1C938C4E861C4214D2B677D05B7C79B
Reporter	Cryptolaemus1
Tags:	10444 Dridex

Cryptolaemus1

Dridex 10444

Intelligence

File Origin

# of uploads :

# of downloads :

109

Origin country :

n/a

Vendor Threat Intelligence

Detection:

DridexLoader

Link:

https://www.capesandbox.com/analysis/127938/

Detection(s):

SecuriteInfo.com.Trojan.Dridex.735.20660.24939.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Sending a UDP request

Sending a custom TCP request

Result

Verdict:

UNKNOWN

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/e968a974cc98a567ecb3af6cb4b4f4d70151ac796c75bafdfad291203adc07ea/

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=5fuks5gmtcswp3ftv5wljnhu24avdldznr23v7p22kisaow4a7va._file

Verdict:

malicious

Label(s):

dridex

Result

Malware family:

dridex

Score:

10/10

Tags:

family:dridex botnet:10444 botnet loader

Link:

https://tria.ge/reports/210330-5t1jbtchzs/

Behaviour

Suspicious use of WriteProcessMemory

Dridex Loader

Dridex

Malware Config

C2 Extraction:

210.65.244.176:443
37.34.58.210:6601
77.220.64.141:5037

Unpacked files

SH256 hash:

38a5de3417f6012bb3876a1f23208da74047376a9cb8fb15b53276104a4e2004

MD5 hash:

bc05f7c26c66bd36a14101bc5852d08d

SHA1 hash:

c560649820e5dffb5c2e117034d4190dc64c9953

Link:

https://www.unpac.me/results/19ef0d8d-ddae-4d4e-81d5-8bde98436b73/

SH256 hash:

e968a974cc98a567ecb3af6cb4b4f4d70151ac796c75bafdfad291203adc07ea

MD5 hash:

145493e8315d2defee67560498664e43

SHA1 hash:

240fac3efd7a453a7cdfefbbf41fb82316433946

Link:

https://www.unpac.me/results/19ef0d8d-ddae-4d4e-81d5-8bde98436b73/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/e968a974cc98a567ecb3af6cb4b4f4d70151ac796c75bafdfad291203adc07ea

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.