🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 07bf10a4d9562de9b3e5e2f93b7a6c323c1695a0d37456d22b4fd8d0e4dfbbe2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Dridex


Vendor detections: 9


Intelligence 9 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 07bf10a4d9562de9b3e5e2f93b7a6c323c1695a0d37456d22b4fd8d0e4dfbbe2
SHA3-384 hash: 13f6069c4e91aa63f91fddf6420de0238503b0fb955a2f32c645c4e8b669c22cdab623a74393dd75d77631a15e60d539
SHA1 hash: 640161f8f6e6343cae2793590a5d27e5b0978ca2
MD5 hash: 2b8681f61b27637fad4a869f6919ae8c
humanhash: five-gee-eighteen-autumn
File name:SecuriteInfo.com.Variant.Fragtor.44159.9257.13268
Download: download sample
Signature Dridex
Create hunting rule
File size:786'432 bytes
First seen:2021-11-24 16:48:41 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash 3408863a87d01409eccbe58d6d3e764c (3 x Dridex)
ssdeep 6144:QmH70ZwiaiIiu4KiU0OiaiOw8i4isCAiKeoiyj3o10Yxc7Ijse4WjPPMOnnnzi1m:JQRDlh/tRVPT1rTjybATge4W70OnG1m
Threatray 5'465 similar samples on MalwareBazaar
TLSH T150F47C67440FD860F6C58A3977BC6885ED85E2628F123FBAB9422C2563352BCD5B3317
Reporter SecuriteInfoCom
Tags:dll Dridex

Intelligence

File Origin
# of uploads :
1
# of downloads :
136
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Detection(s):
SecuriteInfo.com.Variant.Fragtor.44159.9257.13268.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Сreating synchronization primitives
DNS request
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/619e6d02b71ceed4152ebdf6/reports/af5b4503-1d14-45a5-8438-1e6e527f3d55/overview
Malware family:
Dridex
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/24dab590-a2a6-4232-bfa3-7c98eb27e9e5
Result
Threat name:
Dridex
Create hunting rule
Detection:
malicious
Classification:
troj
Score:
68 / 100
Link:
https://www.joesandbox.com/analysis/895571
Signature
C2 URLs / IPs found in malware configuration
Found malware configuration
Multi AV Scanner detection for submitted file
Yara detected Dridex unpacked file
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 528049 Sample: SecuriteInfo.com.Variant.Fr... Startdate: 24/11/2021 Architecture: WINDOWS Score: 68 39 64.251.25.156 INFOLINK-MIA-US United States 2->39 41 185.148.168.15 EVERSCALE-ASDE Germany 2->41 43 2 other IPs or domains 2->43 45 Found malware configuration 2->45 47 Multi AV Scanner detection for submitted file 2->47 49 Yara detected Dridex unpacked file 2->49 51 C2 URLs / IPs found in malware configuration 2->51 9 loaddll32.exe 1 2->9         started        signatures3 process4 process5 11 rundll32.exe 9->11         started        13 rundll32.exe 9->13         started        15 rundll32.exe 9->15         started        17 4 other processes 9->17 process6 19 WerFault.exe 9 11->19         started        21 WerFault.exe 11->21         started        23 WerFault.exe 2 9 13->23         started        25 WerFault.exe 13->25         started        33 2 other processes 15->33 27 rundll32.exe 17->27         started        29 WerFault.exe 9 17->29         started        31 WerFault.exe 9 17->31         started        35 2 other processes 17->35 process7 37 WerFault.exe 23 9 27->37         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/07bf10a4d9562de9b3e5e2f93b7a6c323c1695a0d37456d22b4fd8d0e4dfbbe2/
Threat name:
Win32.Trojan.Drixed
Create hunting rule
Status:
Malicious
First seen:
2021-11-24 15:18:39 UTC
File Type:
PE (Dll)
AV detection:
21 of 27 (77.78%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
doppeldridex
Create hunting rule
dridex
Create hunting rule
Similar samples:
2c54438f5d99d15e5df3965397e25a0fa17ca7f08d317eb4bf31d1268e10f020
Dridex
3cba24dba02d5817a029caee6eadf1b3b4eb75ff861c62df3e4d4fbde1c349c2
Dridex
537866a96449444a54002776f34eecf053c23122a554a79f4743df0749aa8005
Dridex
6865297b72bbfe341d91e32e052debfae3bcd41d8cd883f6bf4a2d665fa00b0f
Dridex
84c54cd76f3ac50f2f2e4afa57802d576bc5dd3c92cde50850feb04e02461ba3
Dridex
bacdb1cfcda34da7422c74810016d80179dc453b29d0121db596fc5346d98cad
Dridex
ec705e006b4074a61b4b001660ce083e1948bb7ef17c69a90ad5ef5bb635d132
Dridex
ef08eafe517a3af06bb806865de42aac88231aac2e1462fa5b44b0db7231cf28
Dridex
f4f0127923c4a1c69aab04516907fd4010f9af8302e132b972d053813577b18d
Dridex
ff277a5e33ec98ad5f0945834f731e39fa2113ac0369ade14fc690a9d1a7cc31
Dridex
+ 5'455 additional samples on MalwareBazaar
Result
Malware family:
dridex
Create hunting rule
Score:
  10/10
Tags:
family:dridex botnet:22202 botnet loader
Link:
https://tria.ge/reports/211124-vbn52sdbgm/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Dridex Loader
Dridex
Malware Config
C2 Extraction:
107.170.4.227:443
178.128.222.53:8116
185.148.168.15:4664
64.251.25.156:6602
Unpacked files
SH256 hash:
e0688ee2807ac01119f453bcf4ff94a5d87087484e8c93ad38fc30b2c189159d
MD5 hash:
5db51257871c8ba67ce4870f096184bf
SHA1 hash:
c3b647f2cdb5d93a4a86a939b05181d80515ce02
Detections:
win_doppeldridex_auto
Create hunting rule
Link:
https://www.unpac.me/results/b7c4a52e-f026-4f0c-9cc1-91a85e961df9/
SH256 hash:
0e7d0c189e4b802906e698d5a1e52c43ca429e8c306bd8abe93175548e0c90a5
MD5 hash:
6ed566b5b06b9b89c4ffbc7aeac172d0
SHA1 hash:
ad265667f3aea6d029f1bbc7f14abeabfd6c5f1b
Detections:
win_dridex_auto
Create hunting rule
Link:
https://www.unpac.me/results/b7c4a52e-f026-4f0c-9cc1-91a85e961df9/
Parent samples :
00af65b613ab193d31ac3c5fbb575e4368de7a0d119caf66a5d4536ad127aec0
07bf10a4d9562de9b3e5e2f93b7a6c323c1695a0d37456d22b4fd8d0e4dfbbe2
6865297b72bbfe341d91e32e052debfae3bcd41d8cd883f6bf4a2d665fa00b0f
SH256 hash:
07bf10a4d9562de9b3e5e2f93b7a6c323c1695a0d37456d22b4fd8d0e4dfbbe2
MD5 hash:
2b8681f61b27637fad4a869f6919ae8c
SHA1 hash:
640161f8f6e6343cae2793590a5d27e5b0978ca2
Link:
https://www.unpac.me/results/b7c4a52e-f026-4f0c-9cc1-91a85e961df9/
Malware family:
Dridex
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/07bf10a4d956/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.14
Link:
https://yomi.yoroi.company/submissions/07bf10a4d9562de9b3e5e2f93b7a6c323c1695a0d37456d22b4fd8d0e4dfbbe2

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DridexV4
Create hunting rule
Author:kevoreilly
Description:Dridex v4 Payload
Rule name:MALWARE_Win_DLLLoader
Create hunting rule
Author:ditekSHen
Description:Detects unknown DLL Loader
Rule name:win_dridex_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.dridex.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Dridex

DLL dll 07bf10a4d9562de9b3e5e2f93b7a6c323c1695a0d37456d22b4fd8d0e4dfbbe2

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1813043/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/209054/

Comments