🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 145b6b65c2627e10b663d7f1609ff56380262d9dc8850b7ac31cb3ee4feb511d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Dridex


Vendor detections: 11


Intelligence 11 IOCs YARA 6 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 145b6b65c2627e10b663d7f1609ff56380262d9dc8850b7ac31cb3ee4feb511d
SHA3-384 hash: ab2956bddd29e12def6e88d4c894bad7689253e806b580b95dbfdc28041c9c770dcf2a00a7d3b1c2247f96d5a2511f8e
SHA1 hash: 2714470b8e3c18118659e6126fb8961f66676de7
MD5 hash: 3c2252f097e7c6f60b3c74bcefeb1c40
humanhash: mobile-nevada-colorado-jig
File name:SecuriteInfo.com.W32.Dridex.GB.genEldorado.18706.19106
Download: download sample
Signature Dridex
Create hunting rule
File size:520'192 bytes
First seen:2021-12-20 23:17:59 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash 2b1b4edc6ebe7eca63696f6220126258 (7 x Dridex)
ssdeep 6144:q5a3RjZ1XrZvR7Z9JrZdR5ZbR1Z9RVZ1RvZpR17fRrZpRrTZRfZ3Rr3fRJZfRlZL:bbTFRJXfZrFTfVBokoa7fGs8E7l
Threatray 5'730 similar samples on MalwareBazaar
TLSH T15BB48E29E83826A4FC351F3875E0B3CEBA53D9145B3B81707B7D9B348782991EC961C6
Reporter SecuriteInfoCom
Tags:dll Dridex

Intelligence

File Origin
# of uploads :
1
# of downloads :
191
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.W32.Dridex.GB.genEldorado.18706.19106.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
DNS request
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/61c10f328991ba72b38f3c39/reports/3313dc23-ee94-412a-a16c-8c99d3cbba32/overview
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/2528bbc0-e561-4ecb-968e-fcc2b98f5c5a
Result
Threat name:
Dridex
Create hunting rule
Detection:
malicious
Classification:
troj
Score:
76 / 100
Link:
https://www.joesandbox.com/analysis/910642
Signature
C2 URLs / IPs found in malware configuration
Found malware configuration
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Sigma detected: Suspicious Call by Ordinal
Yara detected Dridex unpacked file
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 543120 Sample: SecuriteInfo.com.W32.Dridex... Startdate: 21/12/2021 Architecture: WINDOWS Score: 76 17 93.104.209.107 MNET-ASGermanyDE Germany 2->17 19 144.91.122.100 CONTABODE Germany 2->19 21 2 other IPs or domains 2->21 23 Found malware configuration 2->23 25 Multi AV Scanner detection for submitted file 2->25 27 Yara detected Dridex unpacked file 2->27 29 3 other signatures 2->29 9 loaddll32.exe 1 2->9         started        signatures3 process4 process5 11 cmd.exe 1 9->11         started        process6 13 rundll32.exe 11->13         started        process7 15 WerFault.exe 23 9 13->15         started       
Detection:
dridex
Create hunting rule
Link:
https://mwdb.cert.pl/sample/145b6b65c2627e10b663d7f1609ff56380262d9dc8850b7ac31cb3ee4feb511d/
Threat name:
Win32.Worm.Cridex
Create hunting rule
Status:
Malicious
First seen:
2021-12-20 17:27:10 UTC
File Type:
PE (Dll)
AV detection:
23 of 43 (53.49%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=crnwwzocmj7bbntd27ywbh7vmoacmlm5zccqw6wddsz64t7lkeoq._file
Verdict:
malicious
Label(s):
doppeldridex
Create hunting rule
dridex
Create hunting rule
Similar samples:
42a44e52c0b4d3105ce3f46b7ce7bd30eb24c9b320823e1c25d7ca37f1cf32f8
Dridex
594bb2ed8db58f342ea2a9a6cd9f87b102b78538e2e45757a6fa0c83b37b4b38
Dridex
9a92587563a7be70787c52f46a5bbd5240cf012ba5ec77e23d04bda3d652a9c7
Dridex
c4ee2acc6b5aca21235917972c19d30c5585662b59decc6994c54d51bf5d5b80
Dridex
ce02033f92d2acef752f129963acc1e34a00521ad120258685cc52f98b3a603e
Dridex
+ 5'720 additional samples on MalwareBazaar
Result
Malware family:
dridex
Create hunting rule
Score:
  10/10
Tags:
family:dridex botnet:22201 botnet loader
Link:
https://tria.ge/reports/211220-299yqscgek/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Dridex Loader
Dridex
Malware Config
C2 Extraction:
144.91.122.100:443
188.214.241.242:4664
93.104.209.107:8116
5.189.190.214:593
Unpacked files
SH256 hash:
064d2fd9c8ec43ea6d9574620792542faef603c6bcbade86f78013852bdae095
MD5 hash:
9c59068941bfba09f2cba131b5fdde84
SHA1 hash:
5a3533c55cfaf906b1e6fd9f78f93d1227ccfc05
Detections:
win_doppeldridex_auto
Create hunting rule
Link:
https://www.unpac.me/results/08883718-b8b2-4962-8cdf-4a0fe29c598d/
SH256 hash:
4d620a0cd0b47ed20c05c3b96c938d050941f2e2627a9bf088ac8634af7ea4b6
MD5 hash:
ad50cb79d9abe9bf03b81cc1e54b10bf
SHA1 hash:
8b731c9ad3c37461338a4140a1700f4e36baf05f
Detections:
win_dridex_auto
Create hunting rule
Link:
https://www.unpac.me/results/08883718-b8b2-4962-8cdf-4a0fe29c598d/
Parent samples :
594bb2ed8db58f342ea2a9a6cd9f87b102b78538e2e45757a6fa0c83b37b4b38
9a92587563a7be70787c52f46a5bbd5240cf012ba5ec77e23d04bda3d652a9c7
145b6b65c2627e10b663d7f1609ff56380262d9dc8850b7ac31cb3ee4feb511d
94a784a5377541aa2f994182ff9308cc1265938088aa87a2a1d3198f29509793
a4b602ad5624c7570395c8d61fb558727f2e37ce763377d0ddeb93b176b592fb
673ff75f1fc774b6bf83689e9394b17587c795611b3ef2dae9c865bf6949d344
2b25238c00aa0596c7132d869b2a208803a51c22b76e9b22562f930be4d1a17b
SH256 hash:
145b6b65c2627e10b663d7f1609ff56380262d9dc8850b7ac31cb3ee4feb511d
MD5 hash:
3c2252f097e7c6f60b3c74bcefeb1c40
SHA1 hash:
2714470b8e3c18118659e6126fb8961f66676de7
Link:
https://www.unpac.me/results/08883718-b8b2-4962-8cdf-4a0fe29c598d/
Malware family:
Dridex
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/145b6b65c262/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.96
Link:
https://yomi.yoroi.company/submissions/145b6b65c2627e10b663d7f1609ff56380262d9dc8850b7ac31cb3ee4feb511d

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DridexLoader
Create hunting rule
Author:kevoreilly
Description:Dridex v4 dropper C2 parsing function
Rule name:DridexV4
Create hunting rule
Author:kevoreilly
Description:Dridex v4 Payload
Rule name:dridex_loader
Create hunting rule
Author:kevoreilly
Description:Dridex Loader
Rule name:MALWARE_Win_DLLLoader
Create hunting rule
Author:ditekSHen
Description:Detects unknown DLL Loader
Rule name:win_doppeldridex_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.doppeldridex.
Rule name:win_dridex_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.dridex.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Dridex

DLL dll 145b6b65c2627e10b663d7f1609ff56380262d9dc8850b7ac31cb3ee4feb511d

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1903947/
  
Delivery method
Distributed via web download

Comments