MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f62e65a5b9edfeef3217d3e131f8eb63aac24cfdc325f50a4bcdcbb18236196a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Dridex


Vendor detections: 6


Intelligence 6 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f62e65a5b9edfeef3217d3e131f8eb63aac24cfdc325f50a4bcdcbb18236196a
SHA3-384 hash: 67e903c673c40d3a1d8ef71d7df56320375b462b62e8aefaca8d44226e14310c68169629999d980602063f9ca18720bc
SHA1 hash: f4a4c722022217d2f359529897635ef7bca21f39
MD5 hash: 2181b380315f53437f1e895e9563a560
humanhash: high-green-saturn-eight
File name:rh8RGHP6VnRD.dll
Download: download sample
Signature Dridex
Create hunting rule
File size:253'952 bytes
First seen:2021-02-03 18:30:40 UTC
Last seen:2021-02-03 21:01:09 UTC
File type:DLL dll
MIME type:application/x-dosexec
imphash 4627cd6003270b616a4b96f78cbc3f65 (5 x Dridex)
ssdeep 6144:ZSaBi2ZFUOnhD8mc3oOpvXZ26u/6mv5gdC:ZXRZHnhvfOpvXUx/6cgdC
Threatray 83 similar samples on MalwareBazaar
TLSH 8144AE80B287C19FC0620ABC363DE9FC226AFD504720D9353B66712B9D775D1582EBDA
Reporter Anonymous
Tags:dll Dridex

Intelligence

File Origin
# of uploads :
2
# of downloads :
165
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/115409/
Detection(s):
SecuriteInfo.com.ArtemisTrojan.10098.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Sending a UDP request
Result
Threat name:
Dridex
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
84 / 100
Link:
https://www.joesandbox.com/analysis/598454
Signature
C2 URLs / IPs found in malware configuration
Found malware configuration
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
System process connects to network (likely due to code injection or exploit)
Tries to detect sandboxes / dynamic malware analysis system (file name check)
Yara detected Dridex unpacked file
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f62e65a5b9edfeef3217d3e131f8eb63aac24cfdc325f50a4bcdcbb18236196a/
Threat name:
Win32.Infostealer.Dridex
Create hunting rule
Status:
Malicious
First seen:
2021-02-03 18:31:10 UTC
AV detection:
25 of 29 (86.21%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=6yxgljnz5x7o6mqx2pqtd6hlmovmeth5yms7kcslzxf3darwdfva._file
Verdict:
unknown
Similar samples:
11d6703c422ba5ff6cbc0f40c5099a283dfd70fed43d1265366a4919201c6ce0
Dridex
64d66c159e66dd64c42c8c14c2ee67ac868e2910e37ec1dfb60515d0ab76e7b8
Dridex
74f8a8b8f5529c6a47d7c54fbe4a7d526c7de778b522fd2f9538f9a8838eacf7
Dridex
76506e2eab776fca3b25d360c68d7be1fd5f55063319c1977b78634624d29bcc
Dridex
7a91d43923b23b640842519263ff8dc2eb0f411f2f1688727db5c7dfacbab7be
Dridex
8793dc2f1c593a3ccbaf72ff1950d62ba39923c4572d72e06c0b8754980e84c6
Dridex
b2ea69acccab0f220ad7c53d6da1151eab1c9671367d0018e772d925d671f167
Dridex
cba06110bcb612732603556b385dd5926250eaf602fd8fa04327c607bb8a4619
Dridex
ea9efe328c387d0e2db9403cf89c5176f9982cf24b70cd8e83c25045c954a87b
Dridex
f8f9bcb2540f76480d4885c8165f214cc20c8c16061a8b5599d4dd242e316c12
Dridex
+ 73 additional samples on MalwareBazaar
Result
Malware family:
dridex
Create hunting rule
Score:
  10/10
Tags:
family:dridex botnet:111 botnet discovery evasion loader trojan
Link:
https://tria.ge/reports/210203-698gwyl9ls/
Behaviour
Suspicious use of WriteProcessMemory
Checks installed software on the system
Checks whether UAC is enabled
Blocklisted process makes network request
Dridex Loader
Dridex
Malware Config
C2 Extraction:
77.220.64.149:443
80.11.32.115:4646
77.81.247.140:5037
Unpacked files
SH256 hash:
f754ef2c17935c79e523ffaef8048beec4b8ad6a510b1d37dd6a6c5b6467fdcd
MD5 hash:
961e5952e5a74cb20949eb3ad986e933
SHA1 hash:
ac3261e77a7a77429849edadbf10a102f6aaa03f
Link:
https://www.unpac.me/results/58959a3f-463a-48f9-af45-a758bc8af9b2/
SH256 hash:
da3949fefdb3ceb6c153860b92bc39dd12091b8dc9c8242aaddadaeaa4162f0f
MD5 hash:
b901f1e94aafdc3e6fa480cf6e8321b4
SHA1 hash:
ba5afda5c3de706087326a05cd943dc2aee0f190
Link:
https://www.unpac.me/results/58959a3f-463a-48f9-af45-a758bc8af9b2/
SH256 hash:
f62e65a5b9edfeef3217d3e131f8eb63aac24cfdc325f50a4bcdcbb18236196a
MD5 hash:
2181b380315f53437f1e895e9563a560
SHA1 hash:
f4a4c722022217d2f359529897635ef7bca21f39
Link:
https://www.unpac.me/results/58959a3f-463a-48f9-af45-a758bc8af9b2/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/f62e65a5b9edfeef3217d3e131f8eb63aac24cfdc325f50a4bcdcbb18236196a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Keylog_bin_mem
Create hunting rule
Author:James_inthe_box
Description:Contains Keylog
Rule name:MALWARE_Win_DLLLoader
Create hunting rule
Author:ditekSHen
Description:Detects unknown DLL Loader

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other
Cape
Cape
https://www.capesandbox.com/analysis/115409/

Comments