MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fa88b6a5ab9879364ce214e6356052acbabe535c47be3c066f9c3c952af83bbe. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Dridex

Vendor detections: 7

Intelligence 7 IOCs YARA 2 File information Comments

SHA256 hash:	fa88b6a5ab9879364ce214e6356052acbabe535c47be3c066f9c3c952af83bbe
SHA3-384 hash:	4f0b6400520e5b97eb4ebc230d87e36e66350a83ac4d7139ce19b9ecfb26cc940ecc967d883fa77fff7e448c4c4e7f65
SHA1 hash:	ddbd13526fce32cbf01707b0387b6732a8bc1740
MD5 hash:	8f82898a2a363ecf3aa4ad5110485fcc
humanhash:	butter-winter-six-august
File name:	krh92btgk.dll
Download:	download sample
Signature	Dridex Create hunting rule
File size:	928'768 bytes
First seen:	2021-01-25 15:11:51 UTC
Last seen:	2021-01-25 17:23:12 UTC
File type:	dll
MIME type:	application/x-dosexec
imphash	356b1aa4640e3e630debf0f6e3180709 (12 x Dridex)
ssdeep	12288:TLNb4m1ZfLaDI9m8JnbHIRvujOFvUQuIVan2vUggyyt/KVE1lSZsCpieuvC65:Thkm1ZwsHnbH/OBUOtM5ljD
Threatray	293 similar samples on MalwareBazaar
TLSH	5F15F161FE91A438EF2D12344C2BECB80666FD041E69FC6F32DE1E5B1162362F516798
Reporter	JAMESWT_WT
Tags:	dll Dridex

Intelligence

File Origin

# of uploads :

# of downloads :

195

Origin country :

n/a

Vendor Threat Intelligence

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/113729/

Detection(s):

SecuriteInfo.com.Generic.mg.8f82898a2a363ecf.3011.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

DNS request

Sending a UDP request

Connection attempt

Result

Verdict:

UNKNOWN

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Result

Threat name:

Dridex

Detection:

malicious

Classification:

bank.evad

Score:

72 / 100

Link:

https://www.joesandbox.com/analysis/589765

Signature

Detected Dridex e-Banking trojan

Found malware configuration

Multi AV Scanner detection for submitted file

System process connects to network (likely due to code injection or exploit)

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/fa88b6a5ab9879364ce214e6356052acbabe535c47be3c066f9c3c952af83bbe/

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=7kelnjnltb4tmthccttdkycsvs5l4u24i67dybtptq6jkkxyho7a._file

Verdict:

malicious

Label(s):

dridex

gozi

Result

Malware family:

dridex

Score:

10/10

Tags:

family:dridex botnet discovery evasion loader trojan

Link:

https://tria.ge/reports/210125-tr21dtnp9s/

Behaviour

Suspicious use of WriteProcessMemory

Checks installed software on the system

Checks whether UAC is enabled

Blocklisted process makes network request

Dridex Loader

Dridex

Malware Config

C2 Extraction:

97.107.127.161:443
45.33.94.33:5037
159.89.91.92:5037
158.69.118.130:1443

Unpacked files

SH256 hash:

3cfb0d3bb3d3c548aeb602cc58cf0154caf1aa882f20266b2023bce874ee3080

MD5 hash:

f9ad8dbc9c11a6f15a47aed534a57eea

SHA1 hash:

32552eccd888ff5c587ddaf31e45a67f40ead0dd

Link:

https://www.unpac.me/results/35679e4c-cbb1-4b8a-ad1f-4be6f8993c04/

SH256 hash:

fa88b6a5ab9879364ce214e6356052acbabe535c47be3c066f9c3c952af83bbe

MD5 hash:

8f82898a2a363ecf3aa4ad5110485fcc

SHA1 hash:

ddbd13526fce32cbf01707b0387b6732a8bc1740

Link:

https://www.unpac.me/results/35679e4c-cbb1-4b8a-ad1f-4be6f8993c04/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/fa88b6a5ab9879364ce214e6356052acbabe535c47be3c066f9c3c952af83bbe

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.