🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 035b872c1cb731d6df2dfea0c269828c3687c4e543c66d4803d85591f1272f4c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Dridex


Vendor detections: 8


Intelligence 8 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 035b872c1cb731d6df2dfea0c269828c3687c4e543c66d4803d85591f1272f4c
SHA3-384 hash: bbd4b3ce2a861ac1786a3754afc7bc66e891a853bf5ab9ddc1fd128b618b59cfc6ad6d0fa3a913f8fcecf0095a8049a7
SHA1 hash: ea0e39259a0bdd8a237bed914356aa5e4b564f42
MD5 hash: 2a891556a1a126eecdca310bd88fe0c0
humanhash: salami-arkansas-december-oxygen
File name:2a891556a1a126eecdca310bd88fe0c0.dll
Download: download sample
Signature Dridex
Create hunting rule
File size:192'512 bytes
First seen:2021-09-22 18:08:18 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash bc9115da123ae49443de76ad96ad8e1a (7 x Dridex)
ssdeep 3072:8wd4sevPYabz9RLhPO8f3zRCyvD6meTuxn2ZjflxomQYIE5XbiK/n1:BsvQabz9C21Pmb82xnwiX
Threatray 5'017 similar samples on MalwareBazaar
TLSH T10E14D013A6B931D3E19B383F92A1E7B16E386F43C338C45BD6D4F46899312A354A5332
Reporter abuse_ch
Tags:dll Dridex

Intelligence

File Origin
# of uploads :
1
# of downloads :
247
Origin country :
n/a
Vendor Threat Intelligence
Detection:
DridexV4
Create hunting rule
Link:
https://www.capesandbox.com/analysis/190375/
Detection(s):
SecuriteInfo.com.ML.PE-A.101.2162.UNOFFICIAL
Create hunting rule

Malware family:
Dridex
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/78326309-ba48-48a0-8f17-121b8da57ec8
Result
Threat name:
Dridex
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
72 / 100
Link:
https://www.joesandbox.com/analysis/855876
Signature
C2 URLs / IPs found in malware configuration
Found malware configuration
Multi AV Scanner detection for submitted file
Tries to delay execution (extensive OutputDebugStringW loop)
Yara detected Dridex unpacked file
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 488307 Sample: g7BtWqsSBy.dll Startdate: 22/09/2021 Architecture: WINDOWS Score: 72 38 148.251.190.18 HETZNER-ASDE Germany 2->38 40 45.73.148.28 FIBERNET-DIRECTUS United States 2->40 42 202.157.177.65 EXBCOID-AS-APPTEXABYTESNETWORKINDONESIAID Malaysia 2->42 44 Found malware configuration 2->44 46 Multi AV Scanner detection for submitted file 2->46 48 Yara detected Dridex unpacked file 2->48 50 C2 URLs / IPs found in malware configuration 2->50 9 loaddll32.exe 1 2->9         started        signatures3 process4 process5 11 rundll32.exe 9->11         started        14 rundll32.exe 9->14         started        16 cmd.exe 1 9->16         started        18 4 other processes 9->18 signatures6 52 Tries to delay execution (extensive OutputDebugStringW loop) 11->52 20 WerFault.exe 9 11->20         started        22 WerFault.exe 14->22         started        24 WerFault.exe 14->24         started        26 rundll32.exe 16->26         started        28 WerFault.exe 2 9 18->28         started        30 WerFault.exe 9 18->30         started        32 WerFault.exe 18->32         started        34 2 other processes 18->34 process7 process8 36 WerFault.exe 23 9 26->36         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/035b872c1cb731d6df2dfea0c269828c3687c4e543c66d4803d85591f1272f4c/
Threat name:
Win32.Trojan.KryptikAGen
Create hunting rule
Status:
Malicious
First seen:
2021-09-22 16:10:59 UTC
AV detection:
14 of 28 (50.00%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
doppeldridex
Create hunting rule
dridex
Create hunting rule
Similar samples:
125a61ca8cc8e76aeee82a18a0a796e5857df7bf736c494434d14b54766f365a
Dridex
1a05a89e58869e9f5813310a825548dafd49e75da6d4e2b2fbfa33edc3b361db
Dridex
2c390fb974e588b84398b1296d94e68d31d07a802cf47afd126c006e9198771b
Dridex
464f025383d27efe7d46e6745491a86de9a3c0cdd8e133df8f282b6f26091af7
Dridex
7fefd24874a34e614d9089a0a9ebd85458ec71ae328edbd6197a421aec3e2aba
Dridex
9da015c5a2cd9f19365600e478814010b844aff8b2604622cb6298c2567acef8
Dridex
acbcd5ce1579a43148eee9b867f035cd0bc16f237a4790322467a0dac23ce7c6
Dridex
c8341fecb34445b0fb0aea7a560da67979d75d5d4fa85794c00b93d363efd336
Dridex
de592567b9dac437a992f0d9e2defa594d2a269d4f452f772f79bfaabadcbd55
Dridex
f7d5faaf527162e4638350db7a5a79287af9e2a22d3409a75497695eee6e9e5f
Dridex
+ 5'007 additional samples on MalwareBazaar
Result
Malware family:
dridex
Create hunting rule
Score:
  10/10
Tags:
family:dridex botnet:22201 botnet loader
Link:
https://tria.ge/reports/210922-wrhhwadde5/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Dridex Loader
Dridex
Malware Config
C2 Extraction:
148.251.190.18:443
45.73.148.28:10933
202.157.177.65:5412
Unpacked files
SH256 hash:
2fc85ac742a00e89ebd5303911ba98efdfbc9b85012164d339d22a1cd1604376
MD5 hash:
4b8cba9b3faf30826a7eb9a3e041c98d
SHA1 hash:
2d40d9432fce44d7e6c756837427173685c11795
Detections:
win_dridex_auto
Create hunting rule
Link:
https://www.unpac.me/results/b9055199-52be-4846-b9ed-58147b525c1b/
Parent samples :
acbcd5ce1579a43148eee9b867f035cd0bc16f237a4790322467a0dac23ce7c6
c8341fecb34445b0fb0aea7a560da67979d75d5d4fa85794c00b93d363efd336
035b872c1cb731d6df2dfea0c269828c3687c4e543c66d4803d85591f1272f4c
a6d5469211239598d8cb1b2728aac17038aaadff212ef1616e432984e9357426
a6aaa4ffb112d78aa20345821920ce6554d96303f7fb3facb5143de348cf2aae
8f2e0592571ad0147ac0a4fb9c8e8a5fff9ca8ef450b4522ae66aca6243f5138
28222c906d904e9de74b325d5a3fe60d24ffaec03362e0fe904fc49c37ecb434
SH256 hash:
d89de08bf12232ddd89ab6677c1a2c068f86fb44a081989298b44be121693ba4
MD5 hash:
72f8e97d67a22ff67d6d5f54d3a073e0
SHA1 hash:
8ac2560ed577ef02a33dbc24e67cf5aaf74e5328
Detections:
win_doppeldridex_auto
Create hunting rule
Link:
https://www.unpac.me/results/b9055199-52be-4846-b9ed-58147b525c1b/
Parent samples :
acbcd5ce1579a43148eee9b867f035cd0bc16f237a4790322467a0dac23ce7c6
c8341fecb34445b0fb0aea7a560da67979d75d5d4fa85794c00b93d363efd336
035b872c1cb731d6df2dfea0c269828c3687c4e543c66d4803d85591f1272f4c
SH256 hash:
035b872c1cb731d6df2dfea0c269828c3687c4e543c66d4803d85591f1272f4c
MD5 hash:
2a891556a1a126eecdca310bd88fe0c0
SHA1 hash:
ea0e39259a0bdd8a237bed914356aa5e4b564f42
Link:
https://www.unpac.me/results/b9055199-52be-4846-b9ed-58147b525c1b/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.30
Link:
https://yomi.yoroi.company/submissions/035b872c1cb731d6df2dfea0c269828c3687c4e543c66d4803d85591f1272f4c

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Dridex

DLL dll 035b872c1cb731d6df2dfea0c269828c3687c4e543c66d4803d85591f1272f4c

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1639513/
  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/1639530/
  
URLhaus
https://urlhaus.abuse.ch/url/1639724/
  
URLhaus
https://urlhaus.abuse.ch/url/1639727/
  
URLhaus
https://urlhaus.abuse.ch/url/1639748/
  
URLhaus
https://urlhaus.abuse.ch/url/1639787/
Cape
Cape
https://www.capesandbox.com/analysis/190375/

Comments