🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 594bb2ed8db58f342ea2a9a6cd9f87b102b78538e2e45757a6fa0c83b37b4b38. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Dridex


Vendor detections: 11


Intelligence 11 IOCs YARA 6 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 594bb2ed8db58f342ea2a9a6cd9f87b102b78538e2e45757a6fa0c83b37b4b38
SHA3-384 hash: e26bb1b98501707905267731c9f44a8a8f61e98af6936221b65d886a585c8424f8eec7897d9da4b725f2b24d85cd2256
SHA1 hash: 31f6a4339ab43e97453b052a88388efb6c537cb4
MD5 hash: ca318b32105ba9bb1f05d75cac8a650e
humanhash: solar-uniform-autumn-item
File name:triage_dropped_file
Download: download sample
Signature Dridex
Create hunting rule
File size:520'192 bytes
First seen:2021-12-20 14:22:50 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash 2b1b4edc6ebe7eca63696f6220126258 (7 x Dridex)
ssdeep 6144:e5a3RjZ1XrZvR7Z9JrZdR5ZbR1Z9RVZ1RvZpR17fRrZpRrTZRfZ3Rr3fRJZfRlZe:nbTFRJXfZrFTfVBokoa7fGs8l7l
Threatray 5'624 similar samples on MalwareBazaar
TLSH T1DCB48E29E83826A4FC351F3875E0B3CEB653D9145B3B81707B7D9B348782991ECA61C6
Reporter malwarelabnet
Tags:22201 dll Dridex

Intelligence

File Origin
# of uploads :
1
# of downloads :
215
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Packed.Generic-9916977-0
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Searching for the window
DNS request
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/61c091c94ab5c44cbf4a52b8/reports/260e4db8-dd71-41d1-bf86-bd8114a0490e/overview
Gathering data
Result
Threat name:
Dridex
Create hunting rule
Detection:
malicious
Classification:
troj
Score:
76 / 100
Link:
https://www.joesandbox.com/analysis/910303
Signature
C2 URLs / IPs found in malware configuration
Found malware configuration
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Sigma detected: Suspicious Call by Ordinal
Yara detected Dridex unpacked file
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 542781 Sample: triage_dropped_file.dll Startdate: 20/12/2021 Architecture: WINDOWS Score: 76 17 93.104.209.107 MNET-ASGermanyDE Germany 2->17 19 144.91.122.100 CONTABODE Germany 2->19 21 2 other IPs or domains 2->21 23 Found malware configuration 2->23 25 Multi AV Scanner detection for submitted file 2->25 27 Yara detected Dridex unpacked file 2->27 29 3 other signatures 2->29 9 loaddll32.exe 1 2->9         started        signatures3 process4 process5 11 cmd.exe 1 9->11         started        process6 13 rundll32.exe 11->13         started        process7 15 WerFault.exe 23 9 13->15         started       
Detection:
dridex
Create hunting rule
Link:
https://mwdb.cert.pl/sample/594bb2ed8db58f342ea2a9a6cd9f87b102b78538e2e45757a6fa0c83b37b4b38/
Threat name:
Win32.Infostealer.Dridex
Create hunting rule
Status:
Malicious
First seen:
2021-12-20 14:23:09 UTC
File Type:
PE (Dll)
AV detection:
22 of 28 (78.57%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=lff3f3mnwwhtilvcvgtm3h4hweblpbjy4lsfov5g7igihm33jm4a._file
Verdict:
malicious
Label(s):
doppeldridex
Create hunting rule
dridex
Create hunting rule
Similar samples:
2277b7c1b0c715b93395bb6f616d99c7bf5ad8a08236a098d50849267043f2bd
Dridex
4f89bc940e3e26925bd237275e91e979cd3f930ccf7689102ecf74e877f413bb
Dridex
4ff524afd1a400a671e67a3cae5d582bf9c1ea927f430b0b5debc73302c4865f
Dridex
c7115f02b6d2829d45505aa1a9a6e1978d00f57c0180873fa859c29d2d088a66
Dridex
e203ff7d35dd31b84a42961aaf43f7887980469247822c4acb0cfc53be5274ff
Dridex
e44b1a6a58dd89fec8005134c68ae75278904f51f91ecdabc66e59eaf258bb8c
Dridex
fbdbb2388792309d00ba8f6869ff5cc3b7c34097084fef10a0f529153cf83948
Dridex
+ 5'614 additional samples on MalwareBazaar
Result
Malware family:
dridex
Create hunting rule
Score:
  10/10
Tags:
family:dridex botnet:22201 botnet loader
Link:
https://tria.ge/reports/211220-rp5heaaha4/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Dridex Loader
Dridex
Malware Config
C2 Extraction:
144.91.122.100:443
188.214.241.242:4664
93.104.209.107:8116
5.189.190.214:593
Unpacked files
SH256 hash:
4d620a0cd0b47ed20c05c3b96c938d050941f2e2627a9bf088ac8634af7ea4b6
MD5 hash:
ad50cb79d9abe9bf03b81cc1e54b10bf
SHA1 hash:
8b731c9ad3c37461338a4140a1700f4e36baf05f
Detections:
win_dridex_auto
Create hunting rule
Link:
https://www.unpac.me/results/a653bc3f-95fb-4cfc-93e5-ce931be28388/
Parent samples :
594bb2ed8db58f342ea2a9a6cd9f87b102b78538e2e45757a6fa0c83b37b4b38
9a92587563a7be70787c52f46a5bbd5240cf012ba5ec77e23d04bda3d652a9c7
145b6b65c2627e10b663d7f1609ff56380262d9dc8850b7ac31cb3ee4feb511d
94a784a5377541aa2f994182ff9308cc1265938088aa87a2a1d3198f29509793
a4b602ad5624c7570395c8d61fb558727f2e37ce763377d0ddeb93b176b592fb
673ff75f1fc774b6bf83689e9394b17587c795611b3ef2dae9c865bf6949d344
2b25238c00aa0596c7132d869b2a208803a51c22b76e9b22562f930be4d1a17b
SH256 hash:
409b0ea92a0f6b2a101d2682faff2024c29fd7090eeca5bcd81bf33f5c5394c4
MD5 hash:
f3b1e97a38ecd9a175cda5a3c8dfb1bd
SHA1 hash:
567c50d9c3892f1c0b21ae0a6299cd104d3dcd81
Detections:
win_doppeldridex_auto
Create hunting rule
Link:
https://www.unpac.me/results/a653bc3f-95fb-4cfc-93e5-ce931be28388/
SH256 hash:
594bb2ed8db58f342ea2a9a6cd9f87b102b78538e2e45757a6fa0c83b37b4b38
MD5 hash:
ca318b32105ba9bb1f05d75cac8a650e
SHA1 hash:
31f6a4339ab43e97453b052a88388efb6c537cb4
Link:
https://www.unpac.me/results/a653bc3f-95fb-4cfc-93e5-ce931be28388/
Malware family:
Dridex
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/594bb2ed8db5/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.96
Link:
https://yomi.yoroi.company/submissions/594bb2ed8db58f342ea2a9a6cd9f87b102b78538e2e45757a6fa0c83b37b4b38

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DridexLoader
Create hunting rule
Author:kevoreilly
Description:Dridex v4 dropper C2 parsing function
Rule name:DridexV4
Create hunting rule
Author:kevoreilly
Description:Dridex v4 Payload
Rule name:dridex_loader
Create hunting rule
Author:kevoreilly
Description:Dridex Loader
Rule name:MALWARE_Win_DLLLoader
Create hunting rule
Author:ditekSHen
Description:Detects unknown DLL Loader
Rule name:win_doppeldridex_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.doppeldridex.
Rule name:win_dridex_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.dridex.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments