🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 05807cb4a338d25da2da063ed242f25d9747d5eaa77bfc8db5b027a710ffffed. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Dridex


Vendor detections: 11


Intelligence 11 IOCs YARA 2 File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 05807cb4a338d25da2da063ed242f25d9747d5eaa77bfc8db5b027a710ffffed
SHA3-384 hash: 126307a03dfd992ccbdd4184de6f80183168fe477cb809e8feb5dc6906ef9302c0135390a68b20bf6a8b412df2aae089
SHA1 hash: 2710038b1e6c4bf35ab8d6eb47c18f5b81fc7ac5
MD5 hash: 25550ccc81a3d52fcdb0399192cb10af
humanhash: happy-magazine-fanta-leopard
File name:25550ccc81a3d52fcdb0399192cb10af
Download: download sample
Signature Dridex
Create hunting rule
File size:768'000 bytes
First seen:2021-10-27 14:58:02 UTC
Last seen:2021-10-27 17:14:45 UTC
File type:DLL dll
MIME type:application/x-dosexec
imphash 25cb031fe02365eafb637dd0a2254650 (34 x Dridex)
ssdeep 12288:hhB6OmN5lx6S3P8UUY9eHTYtI6jd/Tvyis6SX3hwxwXcKjNE3l7w31TwMGjM/fc:h0LUY9eziI6NT6JtXxwGNCl831TCo/f
Threatray 934 similar samples on MalwareBazaar
TLSH T1A9F4CF1336EAC079D072157841A0B5E05DCDBE61642E9EEBA390323E863ACD2797D71F
Reporter zbetcheckin
Tags:32 dll Dridex exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
99
Origin country :
n/a
Vendor Threat Intelligence
Detection:
DridexLoader
Create hunting rule
Link:
https://www.capesandbox.com/analysis/200582/
Detection(s):
SecuriteInfo.com.UDS.Trojan-Banker.Win32.Cridex.gen.25965.345.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
greyware
Link:
https://www.filescan.io/uploads/617968ffa9d585e6d53b66b1/reports/b05bb383-9e83-4902-987e-5ce296747ee3/overview
Malware family:
Dridex
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/a1605d50-c147-446c-bf25-744a348b2ce3
Result
Threat name:
Dridex
Create hunting rule
Detection:
malicious
Classification:
bank.troj.evad
Score:
88 / 100
Link:
https://www.joesandbox.com/analysis/877851
Signature
C2 URLs / IPs found in malware configuration
Detected Dridex e-Banking trojan
Found malware configuration
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
System process connects to network (likely due to code injection or exploit)
Yara detected Dridex unpacked file
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 510290 Sample: zmgysTwSlN Startdate: 27/10/2021 Architecture: WINDOWS Score: 88 28 Found malware configuration 2->28 30 Multi AV Scanner detection for submitted file 2->30 32 Yara detected Dridex unpacked file 2->32 34 2 other signatures 2->34 7 loaddll32.exe 13 2->7         started        process3 signatures4 38 Detected Dridex e-Banking trojan 7->38 10 cmd.exe 1 7->10         started        12 rundll32.exe 7->12         started        14 rundll32.exe 7->14         started        16 rundll32.exe 7->16         started        process5 process6 18 rundll32.exe 12 10->18         started        dnsIp7 22 185.56.219.47, 49760, 49776, 49778 KELIWEBIT Italy 18->22 24 192.46.210.220, 443, 49746, 49750 FRAUNHOFER-CLUSTER-BWResearchInstitutesspreadalloverGe United States 18->24 26 2 other IPs or domains 18->26 36 System process connects to network (likely due to code injection or exploit) 18->36 signatures8
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/05807cb4a338d25da2da063ed242f25d9747d5eaa77bfc8db5b027a710ffffed/
Threat name:
Win32.Infostealer.Dridex
Create hunting rule
Status:
Malicious
First seen:
2021-10-27 14:13:14 UTC
AV detection:
12 of 27 (44.44%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=awahznfdhdjf3iw2ay7neqxslwlupvpku557zdnvwat2oeh777wq._file
Verdict:
malicious
Label(s):
dridex
Create hunting rule
gozi
Create hunting rule
Similar samples:
240c19f0393b3c0bc6353b5feb1ba39d78aed4102931e4d6cf01bc8ee7979c12
Dridex
24921383732b0349bb1d0fc8c3d0e881b37229254f07f21ee2eab2b06e190f33
Dridex
2ec8b3b5d5d94269fd4db4f1569f6d853f9e1c4543450b40acda09e0a273d666
Dridex
6bdb0fc4446a7c18204baf4225df824e679381d10b5bfc2b95b341d8539b388e
Dridex
a728c51b40b9aa217a0e6b7d27d389325bbe2ff7a275c2a764a2a651d2c7c940
Dridex
b7c20bde2fac641759c56bc29557e38f42399c2806778072ffcf0a550fa7e49d
Dridex
c212d2f1dfa7a4a33c145ab500894eb13ecde04016b8040b3d481a8a6b4298f4
Dridex
c721d124999fe9388e49688994b3316a0b7c4735f96012a5efa20e1aabf87188
Dridex
f1ad281c4e5fb172b2a7f7e7346871bac05665e6a9570745d80b2e43e47da1cb
Dridex
fab5fce8f2f594e2570831bc801ea223169e432c4159312f6546721d8eac6fb5
Dridex
+ 924 additional samples on MalwareBazaar
Result
Malware family:
dridex
Create hunting rule
Score:
  10/10
Tags:
family:dridex botnet:10555 botnet discovery evasion trojan
Link:
https://tria.ge/reports/211027-sb6c8ahbfl/
Behaviour
Suspicious use of WriteProcessMemory
Checks installed software on the system
Checks whether UAC is enabled
Blocklisted process makes network request
Dridex
Malware Config
C2 Extraction:
192.46.210.220:443
143.244.140.214:808
45.77.0.96:6891
185.56.219.47:8116
Unpacked files
SH256 hash:
72e6adab1e4ba7d3c64c2a5d344eab3f9c1090cdab3c821bbb22186989ba0bf5
MD5 hash:
2b5c3edea7fb3284b29a76c5e7dc6352
SHA1 hash:
acc0a2cbe5b307e4fdb67adee676a5575be7b29c
Link:
https://www.unpac.me/results/1e59e8e2-48a1-43a4-836c-372c708271ac/
SH256 hash:
05807cb4a338d25da2da063ed242f25d9747d5eaa77bfc8db5b027a710ffffed
MD5 hash:
25550ccc81a3d52fcdb0399192cb10af
SHA1 hash:
2710038b1e6c4bf35ab8d6eb47c18f5b81fc7ac5
Link:
https://www.unpac.me/results/1e59e8e2-48a1-43a4-836c-372c708271ac/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/05807cb4a338d25da2da063ed242f25d9747d5eaa77bfc8db5b027a710ffffed

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DridexLoader
Create hunting rule
Author:kevoreilly
Description:Dridex v4 dropper C2 parsing function
Rule name:win_dridex_loader_v2
Create hunting rule
Author:Johannes Bader @viql
Description:detects some Dridex loaders

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Dridex

DLL dll 05807cb4a338d25da2da063ed242f25d9747d5eaa77bfc8db5b027a710ffffed

(this sample)

  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/1718769/
  
URLhaus
https://urlhaus.abuse.ch/url/1719778/
Cape
Cape
https://www.capesandbox.com/analysis/200582/

Comments


Avatar
zbet commented on 2021-10-27 14:58:02 UTC

url : hxxp://estudiogflz.com.ar/gi8iali.jpg