MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3cba24dba02d5817a029caee6eadf1b3b4eb75ff861c62df3e4d4fbde1c349c2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Dridex

Vendor detections: 10

Intelligence 10 IOCs YARA 6 File information Comments 1

SHA256 hash:	3cba24dba02d5817a029caee6eadf1b3b4eb75ff861c62df3e4d4fbde1c349c2
SHA3-384 hash:	8fb0554df752db0a2a56cfed3e694ba2c5562f76ef40b083de9ea06ea58b151ff3c52395c1cdca495ebdeb6802ad02e9
SHA1 hash:	7a2c52b1185e6024787eadaf18bd7f7ccfaa0f14
MD5 hash:	aae1e725e2dbfd91213be22e857f9d02
humanhash:	robin-connecticut-west-cola
File name:	aae1e725e2dbfd91213be22e857f9d02
Download:	download sample
Signature	Dridex Create hunting rule
File size:	180'736 bytes
First seen:	2021-07-21 19:37:27 UTC
Last seen:	2021-07-21 21:40:34 UTC
File type:	dll
MIME type:	application/x-dosexec
imphash	458d7355fbf070054838e3593829db8d (10 x Dridex)
ssdeep	3072:TVadvfvemTEtQ9yoZPW/k/nklVtu77wBeZUCEQZRpdBDp57WQhdIif4:4DTyJWPd/nkdqw4/HdB77WQhdIu
Threatray	4'610 similar samples on MalwareBazaar
TLSH	T1C904C077AEDFC0B9F2A39470103437AB26F57A032419F492D661C8DBF83D994A8A4353
Reporter	zbetcheckin
Tags:	32 dll Dridex exe

Intelligence

File Origin

# of uploads :

# of downloads :

130

Origin country :

n/a

Vendor Threat Intelligence

Detection:

DridexLoader

Link:

https://www.capesandbox.com/analysis/173117/

Detection(s):

SecuriteInfo.com.W32.AIDetect.malware2.4396.6574.UNOFFICIAL

Result

Verdict:

UNKNOWN

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Dridex

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/ae70750d-46fb-4a0f-aaef-9d56b790a73d

Result

Threat name:

Dridex

Detection:

malicious

Classification:

troj

Score:

72 / 100

Link:

https://www.joesandbox.com/analysis/819731

Signature

C2 URLs / IPs found in malware configuration

Found malware configuration

Found PHP interpreter

Multi AV Scanner detection for submitted file

Yara detected Dridex unpacked file

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/3cba24dba02d5817a029caee6eadf1b3b4eb75ff861c62df3e4d4fbde1c349c2/

Threat name:

Win32.Packed.Generic

Status:

Suspicious

First seen:

2021-07-21 19:14:32 UTC

AV detection:

11 of 28 (39.29%)

Threat level:

1/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=hs5cjw5afvmbpibjzlxg5lprwo2ow5p7qyogfxz6jvh33yodjhba._file

Verdict:

malicious

Label(s):

doppeldridex

dridex

Result

Malware family:

dridex

Score:

10/10

Tags:

family:dridex botnet:22202 botnet loader

Link:

https://tria.ge/reports/210721-xvtg43shm2/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Program crash

Dridex Loader

Dridex

Malware Config

C2 Extraction:

178.238.236.59:443
104.245.52.73:5007
81.0.236.93:13786

Unpacked files

SH256 hash:

e4686b8bb9aff053052d18387ca360d51ec7770a184121604fb1c0f5256bf16c

MD5 hash:

5eccceba490b23bcc0d98ca4fd5ad6c6

SHA1 hash:

ae236b99b4c2607364290a32ff81d8dfbd610a9c

Detections:

win_doppeldridex_auto

Link:

https://www.unpac.me/results/a904758e-d1dd-418e-89ce-79ba228e1f3d/

Parent samples :

3cba24dba02d5817a029caee6eadf1b3b4eb75ff861c62df3e4d4fbde1c349c2
84c54cd76f3ac50f2f2e4afa57802d576bc5dd3c92cde50850feb04e02461ba3

SH256 hash:

4bf1bf516355e0f25103414a808997b08d457e389db7b592ade4f1d8fabcd6af

MD5 hash:

bfd9fa546f0236471e743c177bcf34a8

SHA1 hash:

31dbab098d7f100a5775e91fd01d224f7671d124

Detections:

win_dridex_auto

Link:

https://www.unpac.me/results/a904758e-d1dd-418e-89ce-79ba228e1f3d/

Parent samples :

2c54438f5d99d15e5df3965397e25a0fa17ca7f08d317eb4bf31d1268e10f020
ec705e006b4074a61b4b001660ce083e1948bb7ef17c69a90ad5ef5bb635d132
3cba24dba02d5817a029caee6eadf1b3b4eb75ff861c62df3e4d4fbde1c349c2
ff277a5e33ec98ad5f0945834f731e39fa2113ac0369ade14fc690a9d1a7cc31
ef08eafe517a3af06bb806865de42aac88231aac2e1462fa5b44b0db7231cf28
84c54cd76f3ac50f2f2e4afa57802d576bc5dd3c92cde50850feb04e02461ba3
bacdb1cfcda34da7422c74810016d80179dc453b29d0121db596fc5346d98cad
537866a96449444a54002776f34eecf053c23122a554a79f4743df0749aa8005
b09882743ed13b041f6b2693943533e4be1e9a5d7e17b701d978d3f4178b76a8
770cb2aa5ea76f90e27bc72110b531fa3985ab4352d25362926971285408f148

SH256 hash:

3cba24dba02d5817a029caee6eadf1b3b4eb75ff861c62df3e4d4fbde1c349c2

MD5 hash:

aae1e725e2dbfd91213be22e857f9d02

SHA1 hash:

7a2c52b1185e6024787eadaf18bd7f7ccfaa0f14

Link:

https://www.unpac.me/results/a904758e-d1dd-418e-89ce-79ba228e1f3d/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Dridex

Score:

0.90

Link:

https://yomi.yoroi.company/submissions/3cba24dba02d5817a029caee6eadf1b3b4eb75ff861c62df3e4d4fbde1c349c2

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	DridexLoader Create hunting rule
Author:	kevoreilly
Description:	Dridex v4 dropper C2 parsing function

Rule name:	DridexV4 Create hunting rule
Author:	kevoreilly
Description:	Dridex v4 Payload

Rule name:	INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFuture Create hunting rule
Author:	ditekSHen
Description:	Detect executables with stomped PE compilation timestamp that is greater than local current time