🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 03ba158e40b1f9c80c0430cd9a06f00bcbddd3826a5965fccb4ac5b242b91a2c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Dridex


Vendor detections: 13


Intelligence 13 IOCs YARA 6 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 03ba158e40b1f9c80c0430cd9a06f00bcbddd3826a5965fccb4ac5b242b91a2c
SHA3-384 hash: 99ff214a51b5cb6a3f7f55e6086d23084601f31db04af42f6ff75bf24e394e78be167d3ebd4d1ec99b4de84ce0650c0f
SHA1 hash: 6e5a7f0493fea40bd213209ad06f4dd9069969ed
MD5 hash: d633b0989e97dc05b09b6233fb53cf37
humanhash: twelve-montana-victor-eight
File name:SecuriteInfo.com.W32.AIDetect.malware1.23460.908
Download: download sample
Signature Dridex
Create hunting rule
File size:544'768 bytes
First seen:2021-12-22 18:05:43 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash e980d287af7ef0ccd616c6efb9daaae8 (19 x Dridex)
ssdeep 6144:0k+RYf/Mv1UvT4vjYf/Glpov3KvfMvLo+jwHk3UryzU3+R7ff4evm35IQku4+pMs:0kt2UAogoOwhx7nA4+pMTg
Threatray 5'744 similar samples on MalwareBazaar
TLSH T1BDC4AE3E5F637898ECCC887A5928D0E893A5778388FC2BFAF154E853147582DB18DD64
Reporter SecuriteInfoCom
Tags:dll Dridex

Intelligence

File Origin
# of uploads :
1
# of downloads :
699
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.W32.AIDetect.malware1.23460.908.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
DNS request
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/61c36915ec6c6c14a9ea8ced/reports/bbc2eef1-cc5a-4229-8150-f340d50ddd23/overview
Malware family:
Dridex
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/5ed53229-7842-4895-9ee0-c2e303a1e034
Result
Threat name:
Dridex
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
76 / 100
Link:
https://www.joesandbox.com/analysis/911705
Signature
C2 URLs / IPs found in malware configuration
Found malware configuration
Multi AV Scanner detection for submitted file
Sigma detected: Suspicious Call by Ordinal
Tries to delay execution (extensive OutputDebugStringW loop)
Yara detected Dridex unpacked file
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 544184 Sample: SecuriteInfo.com.W32.AIDete... Startdate: 22/12/2021 Architecture: WINDOWS Score: 76 18 185.4.135.27 TOPHOSTGR Greece 2->18 20 85.10.248.28 HETZNER-ASDE Germany 2->20 22 2 other IPs or domains 2->22 24 Found malware configuration 2->24 26 Multi AV Scanner detection for submitted file 2->26 28 Yara detected Dridex unpacked file 2->28 30 2 other signatures 2->30 9 loaddll32.exe 1 2->9         started        signatures3 process4 signatures5 32 Tries to delay execution (extensive OutputDebugStringW loop) 9->32 12 cmd.exe 1 9->12         started        process6 process7 14 rundll32.exe 12->14         started        process8 16 WerFault.exe 23 9 14->16         started       
Detection:
dridex
Create hunting rule
Link:
https://mwdb.cert.pl/sample/03ba158e40b1f9c80c0430cd9a06f00bcbddd3826a5965fccb4ac5b242b91a2c/
Threat name:
Win32.Infostealer.Dridex
Create hunting rule
Status:
Malicious
First seen:
2021-12-22 17:57:12 UTC
File Type:
PE (Dll)
AV detection:
22 of 27 (81.48%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ao5bldsawh44qdaegdgzubxqbpf53u4cnjmwl7gljlc3eqvzdiwa._file
Verdict:
malicious
Label(s):
doppeldridex
Create hunting rule
dridex
Create hunting rule
Similar samples:
42a44e52c0b4d3105ce3f46b7ce7bd30eb24c9b320823e1c25d7ca37f1cf32f8
Dridex
c4ee2acc6b5aca21235917972c19d30c5585662b59decc6994c54d51bf5d5b80
Dridex
e90c994527d5fff3e13ff2cc4e28c90cb7ed9fd1d1bfdc214074ca91c484d519
Dridex
edd5c9a776ab5864b62e9ee140d3474ee2fe4c46de591aa3a25bbd133a9f9fe8
Dridex
f2dd8226773272f9aa72fe62608175c2b46edb5d7b151e39d51bc6fe3512f50a
Dridex
+ 5'734 additional samples on MalwareBazaar
Result
Malware family:
dridex
Create hunting rule
Score:
  10/10
Tags:
family:dridex botnet:22201 botnet loader
Link:
https://tria.ge/reports/211222-wprc1agegj/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Dridex Loader
Dridex
Malware Config
C2 Extraction:
144.91.122.102:443
85.10.248.28:593
185.4.135.27:5228
80.211.3.13:8116
Unpacked files
SH256 hash:
3011e5d3cb31140e7915b9c7ca337433bce405c2cac2d93e6383799870a07345
MD5 hash:
2070ea1bba96011e0e3c50f30ca078e0
SHA1 hash:
537bc57f71b9ba48e859cbdf8d201eb3816a7021
Detections:
win_doppeldridex_auto
Create hunting rule
Link:
https://www.unpac.me/results/8719db56-6d15-4eef-a19b-716bf3a3dfbe/
Parent samples :
b06b7b05e576d19367c383aabd9c8fed8cd5e7955e2f1493d326b9b5306c7439
03ba158e40b1f9c80c0430cd9a06f00bcbddd3826a5965fccb4ac5b242b91a2c
SH256 hash:
852226c323edee15bdc0b7ea84dc9502c047a11b02af0aee032781aa512947c6
MD5 hash:
69573713c393260f02fc44e5b8e0c27b
SHA1 hash:
6bda8263774377ee0570310f6b5e97e30c2878a5
Detections:
win_dridex_auto
Create hunting rule
Link:
https://www.unpac.me/results/8719db56-6d15-4eef-a19b-716bf3a3dfbe/
Parent samples :
edd5c9a776ab5864b62e9ee140d3474ee2fe4c46de591aa3a25bbd133a9f9fe8
07c08b4a043b8bc8bea97f36414ae42ade74a37c4d5542727fe6fb0644a48a71
a7efe0ee7f8d77a65b1fff3ba0cee76acb43223365dc348fa43ceecf93bcf7f0
60bd3eba4dac7d37cd07e375f4dbfe5e816b0ab599f28da31c5cf5b180b5849a
0e38ad126b9443e8b13fccbd199e74677800c8a83203f20d4161c1277c44c821
b06b7b05e576d19367c383aabd9c8fed8cd5e7955e2f1493d326b9b5306c7439
03ba158e40b1f9c80c0430cd9a06f00bcbddd3826a5965fccb4ac5b242b91a2c
f54781f5c41ce33227923791ecfd591cb0cbfd446d0d537ca5b2e9477cbf6da3
de171138107af68993856781363643f96bbfa0fc996b89f0cddb08e0b848cfde
77f2ef5318c1769a56e255466a3c7f67ab1c685b40b83a6e1a5303535c098a86
04314613785677f2790e60074119f36d5744df93941c32a5ed37d6b4f577d6f9
215dcfed2662b6c7271ccc2f9b3310dced8f3ffff6ce81c35e3ace792212e152
36a7ba45e945a04424bc1cde56afe70e748bab42bcf53ed459dd6f73bc3ce010
05a16b81c00f57c0bf4ec43f50759006fef117093bc68565c97525374223ff4f
7016f8f68d5288beb0d918f6de14d5aea2e0e7c8881850b9c5d8b688309edc0e
f68d1f0f0d98e40cd449b394d503d508f4933bbd513bf543579fb787a6a2c878
f546f0754cd26d16a43c495fb875760048fb227d9343b7e699befdfea7918547
d0275ec5e9ecaa584f4834bf4882853bfa5b806f684635388b429dc1487d1ae1
a1653f99e47125596487d61c3c66d5d865ba3f0991203203660f51da24cf0f4a
SH256 hash:
03ba158e40b1f9c80c0430cd9a06f00bcbddd3826a5965fccb4ac5b242b91a2c
MD5 hash:
d633b0989e97dc05b09b6233fb53cf37
SHA1 hash:
6e5a7f0493fea40bd213209ad06f4dd9069969ed
Link:
https://www.unpac.me/results/8719db56-6d15-4eef-a19b-716bf3a3dfbe/
Malware family:
Dridex
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/03ba158e40b1/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.96
Link:
https://yomi.yoroi.company/submissions/03ba158e40b1f9c80c0430cd9a06f00bcbddd3826a5965fccb4ac5b242b91a2c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DridexLoader
Create hunting rule
Author:kevoreilly
Description:Dridex v4 dropper C2 parsing function
Rule name:DridexV4
Create hunting rule
Author:kevoreilly
Description:Dridex v4 Payload
Rule name:dridex_loader
Create hunting rule
Author:kevoreilly
Description:Dridex Loader
Rule name:MALWARE_Win_DLLLoader
Create hunting rule
Author:ditekSHen
Description:Detects unknown DLL Loader
Rule name:win_doppeldridex_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.doppeldridex.
Rule name:win_dridex_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.dridex.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Dridex

DLL dll 03ba158e40b1f9c80c0430cd9a06f00bcbddd3826a5965fccb4ac5b242b91a2c

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1910945/
  
Delivery method
Distributed via web download

Comments