MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f14930c641c001377c3c4c468fc97ab43acde69287819c134d529d95c0fb7bb4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Dridex

Vendor detections: 10

Intelligence 10 IOCs YARA 2 File information Comments

SHA256 hash:	f14930c641c001377c3c4c468fc97ab43acde69287819c134d529d95c0fb7bb4
SHA3-384 hash:	84ab604d2cc98bc832c4414af77ecbcd225c07ea2ba3a4563410abe3c0510325c7576f8a6b464073f47e11fb0e16206f
SHA1 hash:	ab103b0c49ed96789a0e1e66cb83273378a99f94
MD5 hash:	d8eedb2803770e9bc95f4de92664bc46
humanhash:	wolfram-seven-artist-twenty
File name:	d8eedb2803770e9bc95f4de92664bc46.dll
Download:	download sample
Signature	Dridex Create hunting rule
File size:	765'440 bytes
First seen:	2021-01-21 07:06:03 UTC
Last seen:	Never
File type:	dll
MIME type:	application/x-dosexec
imphash	1d0c1e9a51da59fb16fe818b175c13c5 (2 x Dridex)
ssdeep	12288:M0q2AejP0XbOAQ60af2rDMmUz0x07wGwefo5SkDw7deUy:f2ejIOU0G2rDMmxxkRT6wy
Threatray	1'216 similar samples on MalwareBazaar
TLSH	24F48C63E6986460F32A073118A3A55387FC7E44CA7DCD9A31CF350B38967B1B52938E
Reporter	abuse_ch
Tags:	dll Dridex

Intelligence

File Origin

# of uploads :

# of downloads :

122

Origin country :

n/a

Vendor Threat Intelligence

Detection:

DridexLoader

Link:

https://www.capesandbox.com/analysis/113226/

Detection(s):

SecuriteInfo.com.Generic.mg.d8eedb2803770e9b.30795.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Sending a UDP request

Sending a custom TCP request

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Result

Threat name:

Unknown

Detection:

malicious

Classification:

evad

Score:

72 / 100

Link:

https://www.joesandbox.com/analysis/586964

Signature

Found malware configuration

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

System process connects to network (likely due to code injection or exploit)

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/f14930c641c001377c3c4c468fc97ab43acde69287819c134d529d95c0fb7bb4/

Threat name:

Win32.Trojan.CrypterX

Status:

Malicious

First seen:

2021-01-20 16:08:21 UTC

AV detection:

13 of 29 (44.83%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=6fetbrsbyaato7b4jrdi7sl2wq5m3zusq6azye2nkkozlqh3po2a._file

Verdict:

malicious

Label(s):

dridex

Result

Malware family:

dridex

Score:

10/10

Tags:

family:dridex botnet loader

Link:

https://tria.ge/reports/210121-92ysxa2j3n/

Behaviour

Suspicious use of WriteProcessMemory

Dridex Loader

Dridex

Malware Config

C2 Extraction:

194.225.58.214:443
211.110.44.63:5353
69.164.207.140:3388
198.57.200.100:3786

Unpacked files

SH256 hash:

1a07ef9634420ac7d115912dce08e6ac12af6e6bd3cbec2ba85d13c22a3f9839

MD5 hash:

b23adcccf7a1ce24586f3cdf1b84e19f

SHA1 hash:

adc240ad8212d425f900d24e27280e456ddfe504

Link:

https://www.unpac.me/results/a80924af-fb32-4d5b-9270-cf9d9f2f7f0d/

SH256 hash:

f14930c641c001377c3c4c468fc97ab43acde69287819c134d529d95c0fb7bb4

MD5 hash:

d8eedb2803770e9bc95f4de92664bc46

SHA1 hash:

ab103b0c49ed96789a0e1e66cb83273378a99f94

Link:

https://www.unpac.me/results/a80924af-fb32-4d5b-9270-cf9d9f2f7f0d/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Dridex

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/f14930c641c001377c3c4c468fc97ab43acde69287819c134d529d95c0fb7bb4

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.