🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 036f5bf868c0b64d27cab3114e173b59456c74ca670185cc417420cf2b2965d7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Dridex


Vendor detections: 10


Intelligence 10 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 036f5bf868c0b64d27cab3114e173b59456c74ca670185cc417420cf2b2965d7
SHA3-384 hash: ec3bc2d803e53a29242776354ae03f968af417989b1f64b3f7bc752ae02b06d712b1ba1ca7d3fb62f08fcdad535d90ad
SHA1 hash: 2b9e0c70f6d055a7d04ec8e7826f8e2b1d70696d
MD5 hash: 6a2d48899c57d400aae8ec0d25d1fa49
humanhash: nineteen-lactose-red-jig
File name:d3dcsx_43.dll
Download: download sample
Signature Dridex
Create hunting rule
File size:192'512 bytes
First seen:2021-08-25 15:07:26 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash 15d931f2533164c416970d03fa5b5c88 (10 x Dridex)
ssdeep 3072:xH0uyjZqEpAK+Gf78TBdrXkTM5vhRg9Esf0DwvtyMpVnpA+z6tX8sxKViW67dU:xUua/Pv7YNhRIEZDeXVpAxtMsxK
Threatray 4'959 similar samples on MalwareBazaar
TLSH T1F914DF82CD9F46F9C21B167139F531BE21E80605A769CC2BCADAD2FBF47D300D46261A
Reporter abuse_ch
Tags:22201 dll Dridex


Avatar
abuse_ch
Dridex payload URL:
https://files.slack.com/files-pri/T02C6AWQFPX-F02CAEANX34/download/d3dcsx_43.dll?pub_secret=60dbc2efeb

Dridex C2:
103.82.248.59:443
54.39.98.141:6602
103.109.247.8:10443

Intelligence

File Origin
# of uploads :
1
# of downloads :
713
Origin country :
n/a
Vendor Threat Intelligence
Detection:
DridexLoader
Create hunting rule
Link:
https://www.capesandbox.com/analysis/182346/
Detection(s):
Win.Packed.Wacatac-9888486-0
Create hunting rule

Win.Packed.Dridex-9888519-0
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Sending a UDP request
Malware family:
Dridex
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/69a85c4e-ba94-448d-b950-95e279e9e846
Result
Threat name:
Dridex
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
68 / 100
Link:
https://www.joesandbox.com/analysis/839172
Signature
C2 URLs / IPs found in malware configuration
Found malware configuration
Found PHP interpreter
Tries to delay execution (extensive OutputDebugStringW loop)
Yara detected Dridex unpacked file
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 471599 Sample: d3dcsx_43.dll Startdate: 25/08/2021 Architecture: WINDOWS Score: 68 32 54.39.98.141 OVHFR Canada 2->32 34 103.109.247.8 IDNIC-UNUSA-AS-IDUniversitasNahdlatulUlamaSurabayaID Indonesia 2->34 36 103.82.248.59 DE-CORPDE-CORPTH Thailand 2->36 38 Found malware configuration 2->38 40 Yara detected Dridex unpacked file 2->40 42 Found PHP interpreter 2->42 44 C2 URLs / IPs found in malware configuration 2->44 9 loaddll32.exe 1 2->9         started        signatures3 process4 process5 11 rundll32.exe 9->11         started        14 rundll32.exe 9->14         started        16 cmd.exe 1 9->16         started        18 5 other processes 9->18 signatures6 46 Tries to delay execution (extensive OutputDebugStringW loop) 11->46 20 WerFault.exe 2 9 14->20         started        22 WerFault.exe 14->22         started        24 rundll32.exe 16->24         started        26 WerFault.exe 9 18->26         started        28 WerFault.exe 9 18->28         started        process7 process8 30 WerFault.exe 23 9 24->30         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/036f5bf868c0b64d27cab3114e173b59456c74ca670185cc417420cf2b2965d7/
Threat name:
Win32.Infostealer.Dridex
Create hunting rule
Status:
Malicious
First seen:
2021-08-25 15:08:20 UTC
AV detection:
18 of 27 (66.67%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
doppeldridex
Create hunting rule
dridex
Create hunting rule
Similar samples:
0c2fb19ab17b0a837a5a0aa838e40945d87d491d879787a754f159239fb06159
Dridex
1b9f7bc405caf49359189d0ff88232f318ba950b42b9aa480267adf3b14d8a84
Dridex
5998ba6bef4d61888a43213a75b78cdf13735906c5b9997f4d41958a513aed70
Dridex
666cea07a8acfbd6bcfd52cd7cdb9668ba9182d92df744868506715b069d0d97
Dridex
6785c64a1bdc72a4c27cf21a478807dac184463945dbec21b3593577335d050c
Dridex
7ce57a5b519458ee81cbb394a3cd50cb8840620e5b0a2451b587ed651b69288b
Dridex
95dcc52232a5e57fc60161b6162a9e0a7fa85098506cac4cbe163f0add8d8e89
Dridex
aa992b53c606223dce46d2b7a1f3cc466d4783a7b5546432b65c661c89f3e006
Dridex
eebfb3d0367d2dad5db7477869bab47f183cbd7a58a48c0592c8e9aa5b38861f
Dridex
fcdb7418de853985a97ec646304c172562701c5f34595eca6e5abe9dd1db66ca
Dridex
+ 4'949 additional samples on MalwareBazaar
Result
Malware family:
dridex
Create hunting rule
Score:
  10/10
Tags:
family:dridex botnet:22201 botnet loader
Link:
https://tria.ge/reports/210825-1l6vdymc5s/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Dridex Loader
Dridex
Malware Config
C2 Extraction:
103.82.248.59:443
54.39.98.141:6602
103.109.247.8:10443
Unpacked files
SH256 hash:
569f7dcf1ea5f9a498efdeabf87caf656e225119e51a5e7cbec886a2ba0e67e3
MD5 hash:
8ff1ec592b93bacad0f323696db39aa4
SHA1 hash:
3133d61689136a691bb65a858edb477f75509517
Detections:
win_dridex_auto
Create hunting rule
Link:
https://www.unpac.me/results/0a65cbe4-e22c-4cc9-b82b-59d9ed4ddaef/
Parent samples :
eebfb3d0367d2dad5db7477869bab47f183cbd7a58a48c0592c8e9aa5b38861f
666cea07a8acfbd6bcfd52cd7cdb9668ba9182d92df744868506715b069d0d97
036f5bf868c0b64d27cab3114e173b59456c74ca670185cc417420cf2b2965d7
adc4b7f058762aabd2b1219a7f18d54b81d740c7ccb23dfb4dac7a83c8443351
3b101aae2d5e4b8656a27cb994e3b6e9909730763f472b60bf715d897ddc24cd
10737be05adc2f1056258e5881c99b04451d7b42de55cc2e6c3f77b8253843e4
4623c6e89423682821cc725e052909efc7705493ab3626d49cdd40f95a0fbe18
7a8e8082b76e9e339be9ce49a93e312f1795b1cee4b7b0ac457089c90e6fd679
11e9ee1999098bb6125423d09c244f818cb267fe0f32ce82463ea9d48815511a
5630750b919ad9a611a2df7b147a1744c5a6a26257c3f40cef1cd0f612f63a7b
SH256 hash:
cbd1044de6b4dd0e2464792664276ea11cca77306a1b3897534ea4e0c86205f2
MD5 hash:
943583c7118f5a1838ca013e958441b2
SHA1 hash:
05a6fa27b474d06b4b66ab4753933b99aaece467
Detections:
win_doppeldridex_auto
Create hunting rule
Link:
https://www.unpac.me/results/0a65cbe4-e22c-4cc9-b82b-59d9ed4ddaef/
SH256 hash:
036f5bf868c0b64d27cab3114e173b59456c74ca670185cc417420cf2b2965d7
MD5 hash:
6a2d48899c57d400aae8ec0d25d1fa49
SHA1 hash:
2b9e0c70f6d055a7d04ec8e7826f8e2b1d70696d
Link:
https://www.unpac.me/results/0a65cbe4-e22c-4cc9-b82b-59d9ed4ddaef/
Malware family:
Dridex
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/036f5bf868c0/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.56
Link:
https://yomi.yoroi.company/submissions/036f5bf868c0b64d27cab3114e173b59456c74ca670185cc417420cf2b2965d7

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Dridex

Excel file xlsx af7015aa503a6ee762e11b6858966afd6593ed2cf9ca4ce6f13297d976616c82

Dridex

DLL dll 036f5bf868c0b64d27cab3114e173b59456c74ca670185cc417420cf2b2965d7

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1563667/
  
Dropped by
MD5 6e0693d6908bd5f3b096a2e345464bf2
  
Dropped by
SHA256 af7015aa503a6ee762e11b6858966afd6593ed2cf9ca4ce6f13297d976616c82
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/182346/
  
URLhaus
https://urlhaus.abuse.ch/url/1563748/
  
URLhaus
https://urlhaus.abuse.ch/url/1563790/

Comments