MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 547e81ee477ae73f30b4435bfa093d48082a0edfa3186a0e4af2eeab60b8d8e0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Dridex


Vendor detections: 11


Intelligence 11 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 547e81ee477ae73f30b4435bfa093d48082a0edfa3186a0e4af2eeab60b8d8e0
SHA3-384 hash: 82d653da2a4f0b26fcd7136aa16ea189bce0f7e55057f08a3a46fe9006c76cba47790241bfafe6893ab81e6ff6647805
SHA1 hash: abea10f0071e1f3785b16c55826c544b157ffe79
MD5 hash: d34090815345e28dd3a62aa3872e472c
humanhash: nuts-bravo-connecticut-butter
File name:LisectAVT_2403002B_213.dll
Download: download sample
Signature Dridex
Create hunting rule
File size:188'416 bytes
First seen:2024-07-25 01:05:47 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash 296c5ce0ec7abebda668048df2df9b05 (17 x Dridex)
ssdeep 3072:sZ/Aq5HJv6rBXHdH1iF3P74buGdSg4GeLfqMsnwXB:sbRQBXHtq3PUbt3te7Bsn
Threatray 17 similar samples on MalwareBazaar
TLSH T16D048E2DE2EFD9A4F6F33630293642219F257C92DA7CDD1C9B08964E98F01E4C994736
TrID 32.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
28.9% (.EXE) Win32 Executable (generic) (4504/4/1)
13.0% (.EXE) OS/2 Executable (generic) (2029/13)
12.8% (.EXE) Generic Win/DOS Executable (2002/3)
12.8% (.EXE) DOS Executable Generic (2000/1)
Reporter Anonymous
Tags:dll Dridex exe


Avatar
Anonymous
this malware sample is very nasty!

Intelligence

File Origin
# of uploads :
1
# of downloads :
353
Origin country :
CN CN
Vendor Threat Intelligence
Detection(s):
Win.Malware.Generic-9835136-0
Create hunting rule

Win.Malware.Fdme-9835139-0
Create hunting rule

Gathering data
Result
Verdict:
Malware
Maliciousness:
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
anti-vm dridex lolbin microsoft_visual_cc packed setupapi
Link:
https://www.filescan.io/uploads/66a1a501dfa8b2fced4e3bfc/reports/fc0eddcd-d10e-4770-ab5e-344e86d0223c/overview
Malware family:
Dridex
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/241dac19-2a47-4244-bcd6-e17ef0988137
Result
Threat name:
Dridex
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
96 / 100
Link:
https://www.joesandbox.com/analysis/1481963
Behaviour
Behavior Graph:
n/a
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/547e81ee477ae73f30b4435bfa093d48082a0edfa3186a0e4af2eeab60b8d8e0
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/547e81ee477ae73f30b4435bfa093d48082a0edfa3186a0e4af2eeab60b8d8e0/
Threat name:
Win32.Trojan.Drixed
Create hunting rule
Status:
Malicious
First seen:
2024-02-27 13:40:00 UTC
File Type:
PE (Dll)
AV detection:
35 of 38 (92.11%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=kr7id3shpltt6mfuinn7ucj5jaecudw7ummgudsk6lxkwyfy3dqa._file
Verdict:
malicious
Label(s):
doppeldridex
Create hunting rule
dridex
Create hunting rule
Similar samples:
00cbdefe7dda0c470d03e1d386acdef065ab738abe0641a42b1ad3d711940914
Dridex
0a082fbd636777d933a585cdbd687e550dcce3048c467e3ac0899dc9ee5a04d3
Dridex
69270306507c02cbcfc8c8432e4cfbe1888c7b23decd2d659caf9375e153713a
Dridex
6b81a2465f8addb72bdf4c947638430d936223ef14c324c09a67ac42ac4250a8
Dridex
a6c0c1e180453c757a95e0f6800cf35e80c31a1d277a0a021ff313bb6f23c952
Dridex
ada6c8cea7615848b5f10965c20743bd9b0ba320c328368c90bb63a1ca0d3582
Dridex
cd7697dbe4ec3ecda59bcaf4a8d15de4cbb2cbed88b3b852fd73926cf040b68b
Dridex
cdc6fdc6cfa18d26713eba66ebe9e3885bea2d8e48f049293706de870126743b
Dridex
d3e4a34d13bbfccea5715e95b34c4b2a61b9c920752865add848cd43eac04869
Dridex
eccd9e2d19947f414025ddca3f91581672443c8c71cf745178c52a168a8e79ae
Dridex
+ 7 additional samples on MalwareBazaar
Result
Malware family:
dridex
Create hunting rule
Score:
  10/10
Tags:
family:dridex botnet:111 botnet discovery evasion loader trojan
Link:
https://tria.ge/reports/240725-bf55ksycmk/
Behaviour
Suspicious use of WriteProcessMemory
System Location Discovery: System Language Discovery
Checks installed software on the system
Checks whether UAC is enabled
Blocklisted process makes network request
Dridex Loader
Dridex
Malware Config
C2 Extraction:
162.13.114.59:443
70.39.99.196:8172
37.187.115.122:6601
Unpacked files
SH256 hash:
bd77a3982f14d0fd645e10d8a11648e1afeac817913babeb58f2d30aadbef303
MD5 hash:
6aede47849a6c4fd29762efdc333191f
SHA1 hash:
3b0483ba8be69e353bf1a4000fdb92906cf643dc
Detections:
win_dridex_auto
Create hunting rule
Link:
https://www.unpac.me/results/e2f6500b-8c87-45b9-87d9-b132784ff5e6/
Parent samples :
cd7697dbe4ec3ecda59bcaf4a8d15de4cbb2cbed88b3b852fd73926cf040b68b
6b81a2465f8addb72bdf4c947638430d936223ef14c324c09a67ac42ac4250a8
0a082fbd636777d933a585cdbd687e550dcce3048c467e3ac0899dc9ee5a04d3
d3e4a34d13bbfccea5715e95b34c4b2a61b9c920752865add848cd43eac04869
00cbdefe7dda0c470d03e1d386acdef065ab738abe0641a42b1ad3d711940914
cdc6fdc6cfa18d26713eba66ebe9e3885bea2d8e48f049293706de870126743b
69270306507c02cbcfc8c8432e4cfbe1888c7b23decd2d659caf9375e153713a
a6c0c1e180453c757a95e0f6800cf35e80c31a1d277a0a021ff313bb6f23c952
eccd9e2d19947f414025ddca3f91581672443c8c71cf745178c52a168a8e79ae
c38acc9a928d97adfde547af10e092940c7d3226cf93f7de46689e8b78702b51
3f9e2f49df05fceef07d02f4fafbe13be1ccda9d6c1a1f6d2c696223aa74a8b7
c30b5746271fe4d4f3af7d6de38356a1da42c3117ad50cf1066631f6f91aa414
6bf9cd30ab801aa6794ba8736e9665d259e4d837a8c599b83c325cdbd50be5b5
ed4fe8fcd0bbc0a3def448a2e59b765136232a733d8d3b0d5388021a6e2cd117
ada6c8cea7615848b5f10965c20743bd9b0ba320c328368c90bb63a1ca0d3582
547e81ee477ae73f30b4435bfa093d48082a0edfa3186a0e4af2eeab60b8d8e0
SH256 hash:
235942956917fca2d89a2d7e73a771daf0f8072384d438ac793ba07f86090f03
MD5 hash:
5a6039528c13751634ee08a1b8bd5f33
SHA1 hash:
b9751a45594a9288c0fc548ac8efab9df5121c1c
Link:
https://www.unpac.me/results/e2f6500b-8c87-45b9-87d9-b132784ff5e6/
SH256 hash:
547e81ee477ae73f30b4435bfa093d48082a0edfa3186a0e4af2eeab60b8d8e0
MD5 hash:
d34090815345e28dd3a62aa3872e472c
SHA1 hash:
abea10f0071e1f3785b16c55826c544b157ffe79
Link:
https://www.unpac.me/results/e2f6500b-8c87-45b9-87d9-b132784ff5e6/
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Check_OutputDebugStringA_iat
Create hunting rule
Rule name:meth_stackstrings
Create hunting rule
Author:Willi Ballenthin

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Dridex

DLL dll 547e81ee477ae73f30b4435bfa093d48082a0edfa3186a0e4af2eeab60b8d8e0

(this sample)

  
Link
https://bbs.kafan.cn/forum-31-1.html
  
Delivery method
Distributed via e-mail attachment

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high
Reviews
IDCapabilitiesEvidence
MULTIMEDIA_APICan Play MultimediaWINMM.dll::mmioSeek
WINMM.dll::timeKillEvent
SECURITY_BASE_APIUses Security Base APIADVAPI32.dll::GetSidIdentifierAuthority
WIN32_PROCESS_APICan Create Process and ThreadsKERNEL32.dll::CloseHandle
WIN_BASE_APIUses Win Base APIKERNEL32.dll::LoadLibraryExA
KERNEL32.dll::LoadLibraryA
KERNEL32.dll::LoadLibraryW
WIN_BASE_USER_APIRetrieves Account InformationKERNEL32.dll::GetComputerNameA
WIN_REG_APICan Manipulate Windows RegistryADVAPI32.dll::RegLoadAppKeyW
WIN_SVC_APICan Manipulate Windows ServicesADVAPI32.dll::OpenServiceA

Comments