MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 eb2f17bca32820d6eb82e422ab8898a1f2c5def0c5c08c1382eac9318f2e4363. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Dridex


Vendor detections: 7


Intelligence 7 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: eb2f17bca32820d6eb82e422ab8898a1f2c5def0c5c08c1382eac9318f2e4363
SHA3-384 hash: 5dc34fef913b395ad183bb441ebdc18d7f3c8ca0d48fbacae645945264a871d04acb4eb3d9334448aee93b9639dd826d
SHA1 hash: b301e113199014bc62260e3c4ab7ded64de848d6
MD5 hash: 7df3e771d596255e68fdfaf138114634
humanhash: batman-quebec-march-bakerloo
File name:7df3e771d596255e68fdfaf138114634.dll
Download: download sample
Signature Dridex
Create hunting rule
File size:576'026 bytes
First seen:2021-03-02 07:14:54 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash 3c0860a13c678470735290ac333e3e38 (5 x Dridex)
ssdeep 6144:pLExaqvRuqh931pIwuZ0/GBzqiH859y1gH67QTy6zmBIUm/acyB0cht0dr3xyFS:pLE0fqhtc05I1h6yi2IUHh/to3
Threatray 4 similar samples on MalwareBazaar
TLSH C1C44A2AF596C0A2D36880B9DCA4FEFD8A853C58CC6084537FD71F0F762E552AB5113A
Reporter abuse_ch
Tags:dll Dridex

Intelligence

File Origin
# of uploads :
1
# of downloads :
116
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/120824/
Detection(s):
SecuriteInfo.com.Trojan.GenericKD.45817489.19288.15320.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Unknown
Detection:
suspicious
Classification:
n/a
Score:
23 / 100
Link:
https://www.joesandbox.com/analysis/623348
Signature
Machine Learning detection for sample
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 360664 Sample: njqv3x02Li.dll Startdate: 02/03/2021 Architecture: WINDOWS Score: 23 34 Machine Learning detection for sample 2->34 14 loaddll32.exe 1 2->14         started        process3 process4 16 rundll32.exe 14->16         started        process5 18 rundll32.exe 16->18         started        process6 20 rundll32.exe 18->20         started        process7 22 rundll32.exe 20->22         started        process8 24 rundll32.exe 22->24         started        process9 26 rundll32.exe 24->26         started        process10 28 rundll32.exe 26->28         started        process11 30 rundll32.exe 28->30         started        process12 32 rundll32.exe 30->32         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/eb2f17bca32820d6eb82e422ab8898a1f2c5def0c5c08c1382eac9318f2e4363/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2021-03-02 07:15:06 UTC
AV detection:
10 of 47 (21.28%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=5mxrppfdfaqnn24c4qrkxceyuhzmlxxqyxaiye4c5letddzoinrq._file
Verdict:
unknown
Similar samples:
16042f7ee3b65617ac8d5ef55668f072be38bd3766b61e8ca8735e4c5012ae8c
Dridex
6277d651c62eac2a706b7a0d027bc4fe91a3b360453e1c3c99ff1fe287ab1dff
Dridex
651a3240a51791a9a14b5df4c42b676442c9d790410bdb083407fa15cf990f83
Dridex
9789e808a4b2da31b349f133baafbfd9e05fc78b598915bb46c492c8aeef317f
Dridex
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/210302-wvdkk4cqa2/
Behaviour
Suspicious use of WriteProcessMemory
Unpacked files
SH256 hash:
eb2f17bca32820d6eb82e422ab8898a1f2c5def0c5c08c1382eac9318f2e4363
MD5 hash:
7df3e771d596255e68fdfaf138114634
SHA1 hash:
b301e113199014bc62260e3c4ab7ded64de848d6
Link:
https://www.unpac.me/results/9049cdf7-74a4-4981-90d2-e6460e897310/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/eb2f17bca32820d6eb82e422ab8898a1f2c5def0c5c08c1382eac9318f2e4363

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DridexLoader
Create hunting rule
Author:kevoreilly
Description:Dridex v4 dropper C2 parsing function
Rule name:win_dridex_loader_v2
Create hunting rule
Author:Johannes Bader @viql
Description:detects some Dridex loaders

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Dridex

DLL dll eb2f17bca32820d6eb82e422ab8898a1f2c5def0c5c08c1382eac9318f2e4363

(this sample)

Cape
Cape
https://www.capesandbox.com/analysis/120824/
  
URLhaus
https://urlhaus.abuse.ch/url/1040345/
  
Delivery method
Distributed via web download

Comments