🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4d8b9bda4573dac3d1f2c1f50fa6c72f1522b575ef69d106732d4a3bdf228a77. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Dridex


Vendor detections: 9


Intelligence 9 IOCs YARA 6 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4d8b9bda4573dac3d1f2c1f50fa6c72f1522b575ef69d106732d4a3bdf228a77
SHA3-384 hash: 1b5e124a6690399d407803afc7e8c6cd0c214c94a894fb2a290b49aacec94b7b46d0e5e77bb95bfdc8952875c480c0a8
SHA1 hash: f70105b263d6324e339017c7db51606c8b24139c
MD5 hash: debdb2d0fbdf8fdc88ef398982d7ea80
humanhash: oscar-green-oranges-dakota
File name:SecuriteInfo.com.W32.AIDetect.malware1.12462.9230
Download: download sample
Signature Dridex
Create hunting rule
File size:786'432 bytes
First seen:2021-11-30 00:40:51 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash 735df7fc35361ede8f9cf4d257872cbb (3 x Dridex)
ssdeep 12288:J+GSWcQaC4+WG4I4+u+AYiu6GEC+uS4au0qO+qkCSqCu+8s+e8enExinN6ZzqZPm:J+GSWcQaC4+WG4I4+u+AYiu6GEC+uS4a
Threatray 5'478 similar samples on MalwareBazaar
TLSH T197F48DC9EA6CC3F4E1046B75A544820B57508929D3F35B8DBCFF02A68E8DEA54C87673
Reporter SecuriteInfoCom
Tags:dll Dridex

Intelligence

File Origin
# of uploads :
1
# of downloads :
160
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.W32.AIDetect.malware1.12462.9230.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Searching for the window
DNS request
Sending a custom TCP request
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
dridex packed
Link:
https://www.filescan.io/uploads/61a5731ebbfd2af97cbb3855/reports/d7f486fb-9b33-41f1-964b-123700985c29/overview
Malware family:
Dridex
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/5d888f92-7dec-41fc-9267-e87397a0546a
Result
Threat name:
Dridex
Create hunting rule
Detection:
malicious
Classification:
troj
Score:
68 / 100
Link:
https://www.joesandbox.com/analysis/898362
Signature
C2 URLs / IPs found in malware configuration
Found malware configuration
Multi AV Scanner detection for submitted file
Yara detected Dridex unpacked file
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 530840 Sample: SecuriteInfo.com.W32.AIDete... Startdate: 30/11/2021 Architecture: WINDOWS Score: 68 33 23.253.208.162 RACKSPACEUS United States 2->33 35 51.68.138.110 OVHFR France 2->35 37 2 other IPs or domains 2->37 39 Found malware configuration 2->39 41 Multi AV Scanner detection for submitted file 2->41 43 Yara detected Dridex unpacked file 2->43 45 C2 URLs / IPs found in malware configuration 2->45 9 loaddll32.exe 1 2->9         started        signatures3 process4 process5 11 cmd.exe 1 9->11         started        13 rundll32.exe 9->13         started        15 rundll32.exe 9->15         started        17 4 other processes 9->17 process6 19 rundll32.exe 11->19         started        21 WerFault.exe 9 13->21         started        23 WerFault.exe 15->23         started        25 WerFault.exe 9 17->25         started        27 WerFault.exe 2 9 17->27         started        29 WerFault.exe 9 17->29         started        process7 31 WerFault.exe 23 9 19->31         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4d8b9bda4573dac3d1f2c1f50fa6c72f1522b575ef69d106732d4a3bdf228a77/
Threat name:
Win32.Trojan.Drixed
Create hunting rule
Status:
Malicious
First seen:
2021-11-29 22:46:33 UTC
File Type:
PE (Dll)
AV detection:
22 of 44 (50.00%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=jwfzxwsfopnmhupsyh2q7jwhf4ksfnlv55u5cbttfvfdxxzcrj3q._file
Verdict:
malicious
Label(s):
doppeldridex
Create hunting rule
dridex
Create hunting rule
Similar samples:
32d52214cf5e988fcea03d7edc9f775b22da0a886c75f37ceebd9a0b054a1391
Dridex
3ea9e629fa353c6e19b68916e613d4cc64101c4f14d011333a6814feeceab404
Dridex
4029e74468c92f45602e675f3f3ec1b45489ca962f36700434021ddc0e3acc26
Dridex
59e61b5ec3eb024ce68f9011a69ccb617120fb95100835d173e44c8dc4d08924
Dridex
7dce4891460d8a95872bb92c7428894b4c467d48af425d96da49f515ff8d0f61
Dridex
8fb997e0c8d5553806303382e7a8efe7756e8340ed23cc21b38afd64ef72e643
Dridex
901782479cf975a8b2811264fd34f2e6fde694dcb968ce8bf502cb054ac9eb5a
Dridex
e5c88a3b3c7e335b83b9823248efeafcc25295a80cde517869ced7580c90a65c
Dridex
+ 5'468 additional samples on MalwareBazaar
Result
Malware family:
dridex
Create hunting rule
Score:
  10/10
Tags:
family:dridex botnet:22204 botnet loader
Link:
https://tria.ge/reports/211130-a1rx1sgbd8/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Dridex Loader
Dridex
Malware Config
C2 Extraction:
51.68.138.110:443
206.189.150.190:8116
103.109.247.10:10443
23.253.208.162:9217
Unpacked files
SH256 hash:
3190f902d8bd71056035df976fa5a0c2ce15de42b97a639b27c378ef13a333b5
MD5 hash:
c1c5cec680ce3e6903d668989cbb7cd3
SHA1 hash:
95bbbef90cafe1e8a78ef8aeaed07ef08646dd18
Detections:
win_doppeldridex_auto
Create hunting rule
Link:
https://www.unpac.me/results/5a923f6e-ee74-495c-a71b-214f76f59095/
SH256 hash:
df25fbf5871c11654e9752832d8c3b283518206e733c1556ffcc4f9944d56c91
MD5 hash:
bdaafb4a6aeadb9f520946a88dca4149
SHA1 hash:
9f84c78f5165757864d0c0c4f190e9a45de90b71
Detections:
win_dridex_auto
Create hunting rule
Link:
https://www.unpac.me/results/5a923f6e-ee74-495c-a71b-214f76f59095/
Parent samples :
9baf70532975e928e6995c20eb3720e606d5b0bd950ec1e684ad4c29037f8499
4d8b9bda4573dac3d1f2c1f50fa6c72f1522b575ef69d106732d4a3bdf228a77
52d877ecef168dbb456884a1fb4d0e00bd703d473dcf8d3f296448103788c215
SH256 hash:
4d8b9bda4573dac3d1f2c1f50fa6c72f1522b575ef69d106732d4a3bdf228a77
MD5 hash:
debdb2d0fbdf8fdc88ef398982d7ea80
SHA1 hash:
f70105b263d6324e339017c7db51606c8b24139c
Link:
https://www.unpac.me/results/5a923f6e-ee74-495c-a71b-214f76f59095/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.14
Link:
https://yomi.yoroi.company/submissions/4d8b9bda4573dac3d1f2c1f50fa6c72f1522b575ef69d106732d4a3bdf228a77

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DridexLoader
Create hunting rule
Author:kevoreilly
Description:Dridex v4 dropper C2 parsing function
Rule name:DridexV4
Create hunting rule
Author:kevoreilly
Description:Dridex v4 Payload
Rule name:dridex_loader
Create hunting rule
Author:kevoreilly
Description:Dridex Loader
Rule name:MALWARE_Win_DLLLoader
Create hunting rule
Author:ditekSHen
Description:Detects unknown DLL Loader
Rule name:win_doppeldridex_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.doppeldridex.
Rule name:win_dridex_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.dridex.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Dridex

DLL dll 4d8b9bda4573dac3d1f2c1f50fa6c72f1522b575ef69d106732d4a3bdf228a77

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1833739/
  
Delivery method
Distributed via web download

Comments