MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 438c66fb365afa484518a37f4c1ad95b9d5d4990ae6e84d3a3609dcba035a415. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Dridex

Vendor detections: 10

Intelligence 10 IOCs YARA 6 File information Comments 1

SHA256 hash:	438c66fb365afa484518a37f4c1ad95b9d5d4990ae6e84d3a3609dcba035a415
SHA3-384 hash:	2034614f6e08990e1f21db43b923e2883e3415d929902ecb319eece784049c2b7de9fb96c43323f178440ffac387f945
SHA1 hash:	f3fe8e21c5e9037030a956ffe694967336392f48
MD5 hash:	643490e54bf3f8046fdc3291706c731e
humanhash:	mirror-golf-missouri-pluto
File name:	643490e54bf3f8046fdc3291706c731e
Download:	download sample
Signature	Dridex Create hunting rule
File size:	179'200 bytes
First seen:	2021-07-27 08:47:40 UTC
Last seen:	Never
File type:	dll
MIME type:	application/x-dosexec
imphash	038ee71bd4ea63acaf586d3475ef17a1 (6 x Dridex)
ssdeep	3072:Z6Y5bY8XE+kkqh84cKcv4FinaLzL2rVQLOmpvNbTAvYstOr18T:cRAkkk84e4wne2nmhFAvY4O
Threatray	8'798 similar samples on MalwareBazaar
TLSH	T1B304CF51D2DF2AD9C41E87BC11947A0976707EC2CB68C078E26AC4BCEF7BD4649E4326
Reporter	zbetcheckin
Tags:	32 dll Dridex exe

Intelligence

File Origin

# of uploads :

# of downloads :

144

Origin country :

n/a

Vendor Threat Intelligence

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/174292/

Detection(s):

SecuriteInfo.com.Variant.Graftor.981531.15369.3544.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Sending a UDP request

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Generic Malware

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/5a39188b-7462-4b67-aa3d-a1a7bd5c284e

Result

Threat name:

Dridex

Detection:

malicious

Classification:

troj.evad

Score:

84 / 100

Link:

https://www.joesandbox.com/analysis/822217

Signature

C2 URLs / IPs found in malware configuration

Found malware configuration

Found PHP interpreter

Found potential dummy code loops (likely to delay analysis)

Machine Learning detection for sample

Multi AV Scanner detection for submitted file

Tries to delay execution (extensive OutputDebugStringW loop)

Yara detected Dridex unpacked file

Behaviour

Behavior Graph:

Download SVG

Gathering data

Threat name:

Win32.Trojan.Convagent

Status:

Malicious

First seen:

2021-07-27 08:46:50 UTC

AV detection:

15 of 46 (32.61%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=ioggn6zwll5eqriyun7uygwzloov2smqvzxiju5dmco4xibvuqkq._file

Verdict:

malicious

Label(s):

doppeldridex

dridex

Result

Malware family:

dridex

Score:

10/10

Tags:

family:dridex botnet:22201 botnet evasion loader trojan

Link:

https://tria.ge/reports/210727-khyytvzyre/

Behaviour

Suspicious use of WriteProcessMemory

Checks whether UAC is enabled

Dridex Loader

Dridex

Malware Config

C2 Extraction:

45.79.33.48:443
139.162.202.74:5007
68.183.216.174:7443

Unpacked files

SH256 hash:

5bf852452d813f27ecf1c13259164766b496f7882acad7794ad5844efe52a72c

MD5 hash:

d3f69f8c8abc8443ed4f96e49ffb6e19

SHA1 hash:

f5083b71c6b22de6592bcff17dfdbdeef3e69654

Detections:

win_dridex_auto

Link:

https://www.unpac.me/results/4ca59e4e-ff41-4dd2-9e46-ea6de111278e/

Parent samples :

b2bcb01b2c4755ae460bcd5d2b80bac2b487c6496f9d2db34a0f84a3ffe6084e
fbd108648a43add9a2e400640f3e60a7f31971d748ad0e3f8531a17fa328e7c6
1718966d91a317e8d16a0015e8f24c295f8ce978af37acef7cdbc9d76934c100
0f52e85eae79fb03bd9b391bc9753417cd066990a41251d385f55e2c9c7b4b53
ccde7438b5015713fef79809dd2fa46a1cd2ee5f81f53b322f3ec716dc6e4e38
438c66fb365afa484518a37f4c1ad95b9d5d4990ae6e84d3a3609dcba035a415

SH256 hash:

b90513b347adf9fda399aa7d787ad27b845fca1740ff6f28af7fdcdda32973c4

MD5 hash:

261ea855c9014d44f2645088cb16ff98

SHA1 hash:

6b8209485b6c535f3340780e319381f8507c28fe

Detections:

win_doppeldridex_auto

Link:

https://www.unpac.me/results/4ca59e4e-ff41-4dd2-9e46-ea6de111278e/

SH256 hash:

438c66fb365afa484518a37f4c1ad95b9d5d4990ae6e84d3a3609dcba035a415

MD5 hash:

643490e54bf3f8046fdc3291706c731e

SHA1 hash:

f3fe8e21c5e9037030a956ffe694967336392f48

Link:

https://www.unpac.me/results/4ca59e4e-ff41-4dd2-9e46-ea6de111278e/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.14

Link:

https://yomi.yoroi.company/submissions/438c66fb365afa484518a37f4c1ad95b9d5d4990ae6e84d3a3609dcba035a415

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	DridexLoader Create hunting rule
Author:	kevoreilly
Description:	Dridex v4 dropper C2 parsing function

Rule name:	DridexV4 Create hunting rule
Author:	kevoreilly
Description:	Dridex v4 Payload

Rule name:	INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFuture Create hunting rule
Author:	ditekSHen
Description:	Detect executables with stomped PE compilation timestamp that is greater than local current time

Rule name:	MALWARE_Win_DLLLoader Create hunting rule
Author:	ditekSHen
Description:	Detects unknown DLL Loader

Rule name:	win_doppeldridex_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	Detects win.doppeldridex.

Rule name:	win_dridex_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	Detects win.dridex.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Dridex

DLL dll 438c66fb365afa484518a37f4c1ad95b9d5d4990ae6e84d3a3609dcba035a415

(this sample)

Delivery method

Distributed via web download

URLhaus

https://urlhaus.abuse.ch/url/1484145/

Cape

https://www.capesandbox.com/analysis/174292/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

zbet commented on 2021-07-27 08:47:40 UTC

url : hxxp://immidiateupdates.com:8088/wp-theme/filler_QEtsU.png