🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 32d586a56d67479bfb6a97af3946d36eef30763c090fe183ea859235b2b41be2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Dridex


Vendor detections: 10


Intelligence 10 IOCs YARA 8 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 32d586a56d67479bfb6a97af3946d36eef30763c090fe183ea859235b2b41be2
SHA3-384 hash: 44337b7bc01f3c279f519c815d0e1bef34532e600ee47e10e7f0776b50fc9f9a452659a38b45ae2c0b4e779514243fb4
SHA1 hash: e16da3924cd9bd42a2414627bf0137c3508edb49
MD5 hash: e1106797647ca122fa34e757632c146a
humanhash: batman-johnny-washington-earth
File name:SecuriteInfo.com.Trojan.Dridex.777.11918.677
Download: download sample
Signature Dridex
Create hunting rule
File size:668'520 bytes
First seen:2021-11-18 00:00:27 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash b7c97a32f8446f2667c75327c69c37cd (3 x Dridex)
ssdeep 6144:LHG2WUYYUeWUkWk+WUCWUmWUOWUwWUA4UUWqqWUGWU8YUCWC4WUiWUrHw9GlzgYy:KOHwszfO5snBpZf4w0IAZd
Threatray 5'365 similar samples on MalwareBazaar
TLSH T1C3E4B01E7188C05BC5CAACB974B37B646585943C2DE9A4F7F06336A8D74B2B8BC17078
Reporter SecuriteInfoCom
Tags:dll Dridex

Intelligence

File Origin
# of uploads :
1
# of downloads :
172
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Detection(s):
SecuriteInfo.com.Trojan.Dridex.777.11918.677.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
DNS request
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
overlay packed
Link:
https://www.filescan.io/uploads/619597c643e8f62b6697cced/reports/0fa579f1-8d47-4100-8471-109f8707acb1/overview
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/3455051c-6573-424c-b8d9-14fba259d628
Result
Threat name:
Dridex
Create hunting rule
Detection:
malicious
Classification:
troj
Score:
68 / 100
Link:
https://www.joesandbox.com/analysis/891624
Signature
C2 URLs / IPs found in malware configuration
Found malware configuration
Multi AV Scanner detection for submitted file
Yara detected Dridex unpacked file
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 524099 Sample: SecuriteInfo.com.Trojan.Dri... Startdate: 18/11/2021 Architecture: WINDOWS Score: 68 17 54.37.70.105 OVHFR France 2->17 19 142.93.218.86 DIGITALOCEAN-ASNUS United States 2->19 21 2 other IPs or domains 2->21 23 Found malware configuration 2->23 25 Multi AV Scanner detection for submitted file 2->25 27 Yara detected Dridex unpacked file 2->27 29 C2 URLs / IPs found in malware configuration 2->29 9 loaddll32.exe 1 2->9         started        signatures3 process4 process5 11 cmd.exe 1 9->11         started        process6 13 rundll32.exe 11->13         started        process7 15 WerFault.exe 23 9 13->15         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/32d586a56d67479bfb6a97af3946d36eef30763c090fe183ea859235b2b41be2/
Threat name:
Win32.Trojan.Drixed
Create hunting rule
Status:
Malicious
First seen:
2021-11-17 23:33:43 UTC
AV detection:
12 of 44 (27.27%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=glkynjlnm5dzx63ks6xtsrwtn3xta5r4beh6da7kqwjdlmvudpra._file
Verdict:
malicious
Label(s):
doppeldridex
Create hunting rule
dridex
Create hunting rule
Similar samples:
233abb27be4c337cf8b9999c58b73e5890a61741c896e3afe8794b13d5652eb5
Dridex
2bf87021745923bb669cc6eda22bb54b5249f74f7e7e8a04ebc4f16b01a0a8c4
Dridex
2c74a51c3843ccb411702e116ee7bf7c9efa3d53cbaf3709e789a6305a8ac67f
Dridex
32f0692da6367489eafc71602a1b075e177621e366101241206958a68318cf64
Dridex
33df285d24bac325fa5c56a08462a3ebf34904e4489abe7e6854f3f993ac033f
Dridex
832cd5a0d475e0309f03bd6a00ae888e0be1c6a8585f9175e0dbe41d3fc960a6
Dridex
8536dd733f30a414cb8040e2d15631e1124942b150c75a2ef9178e61d2a75689
Dridex
85dd0bbdc1dde143ffd3906d04ce15fa415b0f66abfaeb1f3476007c5664438e
Dridex
a3abf81a46e3e318450f496e08d8cd0c9952f43deb4c481e19f9cfd36e884f2a
Dridex
dee4e7db5288498de87f415981fbaec17e88dc9fdef3dbcc5aac39395aafe5ea
Dridex
+ 5'355 additional samples on MalwareBazaar
Result
Malware family:
dridex
Create hunting rule
Score:
  10/10
Tags:
family:dridex botnet:22203 botnet loader
Link:
https://tria.ge/reports/211118-aaw42sedb4/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Dridex Loader
Dridex
Malware Config
C2 Extraction:
54.37.70.105:443
198.199.70.22:6602
164.68.99.3:5007
142.93.218.86:4664
Unpacked files
SH256 hash:
67ef5a4eae647c84bbf565127189d693aea067ac3c4263ace6804f8621afd086
MD5 hash:
f59d5559c9766bf2790c5705fe31342f
SHA1 hash:
f08f79ba565702b6987d2b50448eac449f9ebe12
Detections:
win_dridex_auto
Create hunting rule
Link:
https://www.unpac.me/results/c24a63bd-b339-4cbc-8f8f-70f003b345d0/
Parent samples :
dee4e7db5288498de87f415981fbaec17e88dc9fdef3dbcc5aac39395aafe5ea
32d586a56d67479bfb6a97af3946d36eef30763c090fe183ea859235b2b41be2
caaac89a744e94aa0735d858e6d30445a5f92e7fe4c9bdbcd1a1bd92e626fcc7
SH256 hash:
992a479c08156feecf8a7fe89b28f4497a4b390bc518a85e766503956852c127
MD5 hash:
b612a59a7ceb1710568cf6c5a9c88226
SHA1 hash:
49d62c4217e792026a8cab720a9fb8ec7b048353
Detections:
win_doppeldridex_auto
Create hunting rule
Link:
https://www.unpac.me/results/c24a63bd-b339-4cbc-8f8f-70f003b345d0/
SH256 hash:
32d586a56d67479bfb6a97af3946d36eef30763c090fe183ea859235b2b41be2
MD5 hash:
e1106797647ca122fa34e757632c146a
SHA1 hash:
e16da3924cd9bd42a2414627bf0137c3508edb49
Link:
https://www.unpac.me/results/c24a63bd-b339-4cbc-8f8f-70f003b345d0/
Malware family:
Dridex
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/32d586a56d67/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/32d586a56d67479bfb6a97af3946d36eef30763c090fe183ea859235b2b41be2

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DridexLoader
Create hunting rule
Author:kevoreilly
Description:Dridex v4 dropper C2 parsing function
Rule name:DridexV4
Create hunting rule
Author:kevoreilly
Description:Dridex v4 Payload
Rule name:dridex_loader
Create hunting rule
Author:kevoreilly
Description:Dridex Loader
Rule name:MALWARE_Win_DLLLoader
Create hunting rule
Author:ditekSHen
Description:Detects unknown DLL Loader
Rule name:Sectigo_Code_Signed
Create hunting rule
Description:Detects code signed by the Sectigo RSA Code Signing CA
Reference:https://bazaar.abuse.ch/export/csv/cscb/
Rule name:Sectigo_Code_Signed
Create hunting rule
Description:Detects code signed by the Sectigo RSA Code Signing CA
Reference:https://bazaar.abuse.ch/export/csv/cscb/
Rule name:win_doppeldridex_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.doppeldridex.
Rule name:win_dridex_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.dridex.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Dridex

DLL dll 32d586a56d67479bfb6a97af3946d36eef30763c090fe183ea859235b2b41be2

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1798194/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/207029/

Comments