🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5aab487dfb1bd8c811dcc0fa8c9c9e762bb8df69424fd585d60a4bba53664599. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Dridex


Vendor detections: 9


Intelligence 9 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5aab487dfb1bd8c811dcc0fa8c9c9e762bb8df69424fd585d60a4bba53664599
SHA3-384 hash: fc7c1da12a056bcfa89df924ee861dce959b50e1760fbfacd953ac5c0a04840d97cf568dd5ee41f899fbfa3c2ccae213
SHA1 hash: bda7bb6814ac4c3885ec74b9508c3a33e4082a25
MD5 hash: ee83985f96d95a6cbdd3e8f1ef7dc944
humanhash: don-avocado-leopard-shade
File name:SecuriteInfo.com.W32.AIDetect.malware2.8842.10631
Download: download sample
Signature Dridex
Create hunting rule
File size:438'272 bytes
First seen:2021-11-22 20:57:22 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash 8dec1a105645cd34f7153c99220eeea4 (17 x Dridex)
ssdeep 6144:oXaMQWTCJkdk5k7kBM7A9kkr+pt4PlaMEQ/j8I0r6BHAE7Q4k:o1maeqIGs+N4kMEyg6uEsp
Threatray 5'457 similar samples on MalwareBazaar
TLSH T1A6949E80F32B83E4DE09DE3B04FC985C153856E8FF5B16D5739C81FC35E49A898A6629
Reporter SecuriteInfoCom
Tags:dll Dridex

Intelligence

File Origin
# of uploads :
1
# of downloads :
130
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Detection(s):
SecuriteInfo.com.W32.AIDetect.malware2.8842.10631.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Searching for the window
Сreating synchronization primitives
DNS request
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/619c046a94a88037d2ff1702/reports/cb65ecde-1557-475a-8cfb-e9ce46d3e929/overview
Malware family:
Dridex
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/a7bc2901-a76e-44e9-bef5-9e36d99b269b
Result
Threat name:
Dridex
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
72 / 100
Link:
https://www.joesandbox.com/analysis/894240
Signature
C2 URLs / IPs found in malware configuration
Found malware configuration
Multi AV Scanner detection for submitted file
Tries to delay execution (extensive OutputDebugStringW loop)
Yara detected Dridex unpacked file
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 526717 Sample: SecuriteInfo.com.W32.AIDete... Startdate: 22/11/2021 Architecture: WINDOWS Score: 72 41 188.165.214.166 OVHFR France 2->41 43 67.207.95.35 DIGITALOCEAN-ASNUS United States 2->43 45 2 other IPs or domains 2->45 49 Found malware configuration 2->49 51 Multi AV Scanner detection for submitted file 2->51 53 Yara detected Dridex unpacked file 2->53 55 C2 URLs / IPs found in malware configuration 2->55 9 loaddll32.exe 1 2->9         started        signatures3 process4 process5 11 rundll32.exe 9->11         started        14 rundll32.exe 9->14         started        16 rundll32.exe 9->16         started        18 4 other processes 9->18 signatures6 57 Tries to delay execution (extensive OutputDebugStringW loop) 11->57 20 WerFault.exe 11 11->20         started        22 WerFault.exe 9 14->22         started        25 WerFault.exe 14->25         started        27 WerFault.exe 16->27         started        29 WerFault.exe 16->29         started        31 rundll32.exe 18->31         started        33 WerFault.exe 9 18->33         started        35 WerFault.exe 2 9 18->35         started        37 2 other processes 18->37 process7 dnsIp8 47 192.168.2.1 unknown unknown 22->47 39 WerFault.exe 23 9 31->39         started        process9
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/5aab487dfb1bd8c811dcc0fa8c9c9e762bb8df69424fd585d60a4bba53664599/
Threat name:
Win32.Trojan.Drixed
Create hunting rule
Status:
Malicious
First seen:
2021-11-22 20:04:27 UTC
File Type:
PE (Dll)
AV detection:
20 of 28 (71.43%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
doppeldridex
Create hunting rule
dridex
Create hunting rule
Similar samples:
2dd54462c65a469a2611be091d84fa71a4c1b5b61d020f4058296153941d9e13
Dridex
bb8481137fc9cc71e49c6a2aefb846091f1810ad9d17b71d64713cda7cb9d3a3
Dridex
c1194b3b9e8e8900d6010d77874ad396c67272a57d526db7d21887a90bcbdbe4
Dridex
cc31d1c3648d35d98c16d49ff17e290b07f431ccd23434b50c905c2aa4ba8f38
Dridex
ddcaa1c7ba38d83e0f34da7cce150905cd0246f15334b9feadd8dcab5cd991ee
Dridex
ed8defd4e1e81fbc877f7419d6593303403504f4ea02de07085ea94d6ad78e18
Dridex
ee1259ba7e41be5e8f11fb7ed2fb983bd9a48e757cf59690336aa63ac2497dba
Dridex
+ 5'447 additional samples on MalwareBazaar
Result
Malware family:
dridex
Create hunting rule
Score:
  10/10
Tags:
family:dridex botnet:22203 botnet loader
Link:
https://tria.ge/reports/211122-zr6r9agghp/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Dridex Loader
Dridex
Malware Config
C2 Extraction:
67.207.95.35:443
86.107.98.232:8333
188.165.214.166:4664
144.91.110.219:9217
Unpacked files
SH256 hash:
c9a4621fd7c05fd84cdb4381789f16aee72635f116a5d5cca98b9d89e4069a9b
MD5 hash:
25e08102352d83395dbceb0445cb88d8
SHA1 hash:
9994341a7280113e0a09fbcd503a359b112d40dd
Detections:
win_dridex_auto
Create hunting rule
Link:
https://www.unpac.me/results/2264894a-730c-442a-9ef1-b76cd9ca8303/
Parent samples :
cc31d1c3648d35d98c16d49ff17e290b07f431ccd23434b50c905c2aa4ba8f38
2dd54462c65a469a2611be091d84fa71a4c1b5b61d020f4058296153941d9e13
ee1259ba7e41be5e8f11fb7ed2fb983bd9a48e757cf59690336aa63ac2497dba
92a5ea2c1f1cc5177f54568b6d6b878f46a2bd3e49daf93f6385d304dcc1ee40
ba5fb468274de91023a4b8d14ff5b79a5531fed3cc818cdc93969b5fdb1a309d
b169abddcc96b1c9b61cd112734ad9e1d13af76ac9eb33b12c00fec870ed322d
2db0e926b1d6d60ab8138c008be5cad1ee2dda7a2cbbd27496953a97464b7511
8cb564d0a6548b35d96707b24a90ec361d82098f25381257fb8300ee5d27c6dc
106cd82325eacb5a9eedef1a7e54a9ad4e982469abe0b54583fbd4b8a0bd35f2
553cce1f64c0364094da5b64103f5bf184559eb9a4f7ebc5e14897b89ab6eda1
887f1d15b4c5a13871220261516df2fdb3410ed7a8b6088deee0d38610cbe68a
5aab487dfb1bd8c811dcc0fa8c9c9e762bb8df69424fd585d60a4bba53664599
ddcaa1c7ba38d83e0f34da7cce150905cd0246f15334b9feadd8dcab5cd991ee
b1029b6074fcc508c36bfd3c9c1ec582da3650faae2a9af1eb867ad3e05fc513
5cb8c6baf6d41a0dd663d092ebb31ef7bdaa4370fb0f8cb6fd35b6a8744f31c9
be193b9e9d20df4110f8da469af38bb99f445a173b13d1941da6be8d8c81d1fd
5092d010953226e366db6d47af4bf9886179ea6eb2655f3e70d4a1a82af1c7d5
SH256 hash:
f4f71b9317bac2db1aedcbe90baed894f3e40af25bebb374e717bd35a59e932b
MD5 hash:
e8d3a29032d6046696d3a3c6bc3334ab
SHA1 hash:
d2a3e2fb32e9859bf97f4a3e2a95b49e003735de
Detections:
win_doppeldridex_auto
Create hunting rule
Link:
https://www.unpac.me/results/2264894a-730c-442a-9ef1-b76cd9ca8303/
Parent samples :
b169abddcc96b1c9b61cd112734ad9e1d13af76ac9eb33b12c00fec870ed322d
2db0e926b1d6d60ab8138c008be5cad1ee2dda7a2cbbd27496953a97464b7511
106cd82325eacb5a9eedef1a7e54a9ad4e982469abe0b54583fbd4b8a0bd35f2
5aab487dfb1bd8c811dcc0fa8c9c9e762bb8df69424fd585d60a4bba53664599
be193b9e9d20df4110f8da469af38bb99f445a173b13d1941da6be8d8c81d1fd
SH256 hash:
5aab487dfb1bd8c811dcc0fa8c9c9e762bb8df69424fd585d60a4bba53664599
MD5 hash:
ee83985f96d95a6cbdd3e8f1ef7dc944
SHA1 hash:
bda7bb6814ac4c3885ec74b9508c3a33e4082a25
Link:
https://www.unpac.me/results/2264894a-730c-442a-9ef1-b76cd9ca8303/
Malware family:
Dridex
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/5aab487dfb1b/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.14
Link:
https://yomi.yoroi.company/submissions/5aab487dfb1bd8c811dcc0fa8c9c9e762bb8df69424fd585d60a4bba53664599

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Dridex

DLL dll 5aab487dfb1bd8c811dcc0fa8c9c9e762bb8df69424fd585d60a4bba53664599

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1806263/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/208407/

Comments