🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5cb8c6baf6d41a0dd663d092ebb31ef7bdaa4370fb0f8cb6fd35b6a8744f31c9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Dridex


Vendor detections: 9


Intelligence 9 IOCs YARA 6 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5cb8c6baf6d41a0dd663d092ebb31ef7bdaa4370fb0f8cb6fd35b6a8744f31c9
SHA3-384 hash: 401a8584dfaa3ab13a1e5064ed1a47a08a8b28e8383257df73f86ce0fc7d920aac0ee7219d9d8ce08f06b01eec88590b
SHA1 hash: edebdd979430258f89db7bf02d9a2b653ed0f8f7
MD5 hash: f3a6bac3b47e4dba8c9a05905e519a0a
humanhash: pasta-fish-vegan-beryllium
File name:SecuriteInfo.com.W32.AIDetect.malware2.21196.25721
Download: download sample
Signature Dridex
Create hunting rule
File size:438'272 bytes
First seen:2021-11-22 20:57:46 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash 8dec1a105645cd34f7153c99220eeea4 (17 x Dridex)
ssdeep 6144:iqaMQWTCJkdk5k7kBM7A9kkr+pt4PlaMEQ/j8I0r6BHAE754k:i8maeqIGs+N4kMEyg6uEFp
Threatray 5'444 similar samples on MalwareBazaar
TLSH T13B949F80F32B83E4DE09DE3B04FC985C153856E8FF5B16D5739C81FC35E49A898A6629
Reporter SecuriteInfoCom
Tags:dll Dridex

Intelligence

File Origin
# of uploads :
1
# of downloads :
158
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Detection(s):
SecuriteInfo.com.W32.AIDetect.malware2.21196.25721.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Searching for the window
Сreating synchronization primitives
DNS request
Launching a process
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/619c047add04e7d00e02bfba/reports/a082a8e2-14f2-42d0-8b0c-7f489a8f3934/overview
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/e6956e40-14f9-4846-8d9b-e98aae73088a
Result
Threat name:
Dridex
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
72 / 100
Link:
https://www.joesandbox.com/analysis/894193
Signature
C2 URLs / IPs found in malware configuration
Found malware configuration
Multi AV Scanner detection for submitted file
Tries to delay execution (extensive OutputDebugStringW loop)
Yara detected Dridex unpacked file
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 526671 Sample: SecuriteInfo.com.W32.AIDete... Startdate: 22/11/2021 Architecture: WINDOWS Score: 72 41 188.165.214.166 OVHFR France 2->41 43 67.207.95.35 DIGITALOCEAN-ASNUS United States 2->43 45 2 other IPs or domains 2->45 49 Found malware configuration 2->49 51 Multi AV Scanner detection for submitted file 2->51 53 Yara detected Dridex unpacked file 2->53 55 C2 URLs / IPs found in malware configuration 2->55 9 loaddll32.exe 1 2->9         started        signatures3 process4 process5 11 rundll32.exe 9->11         started        14 rundll32.exe 9->14         started        16 rundll32.exe 9->16         started        18 5 other processes 9->18 signatures6 57 Tries to delay execution (extensive OutputDebugStringW loop) 11->57 20 WerFault.exe 9 11->20         started        22 WerFault.exe 9 14->22         started        25 WerFault.exe 14->25         started        27 WerFault.exe 16->27         started        29 WerFault.exe 16->29         started        31 rundll32.exe 18->31         started        33 WerFault.exe 18->33         started        35 WerFault.exe 18->35         started        37 WerFault.exe 18->37         started        process7 dnsIp8 47 192.168.2.1 unknown unknown 22->47 39 WerFault.exe 23 9 31->39         started        process9
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/5cb8c6baf6d41a0dd663d092ebb31ef7bdaa4370fb0f8cb6fd35b6a8744f31c9/
Threat name:
Win32.Infostealer.Dridex
Create hunting rule
Status:
Malicious
First seen:
2021-11-22 20:04:27 UTC
File Type:
PE (Dll)
AV detection:
22 of 28 (78.57%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ls4mnoxw2qna3vtd2cjoxmy66662uq3q7mhyznx5gw3kq5cpgheq._file
Verdict:
malicious
Label(s):
doppeldridex
Create hunting rule
dridex
Create hunting rule
Similar samples:
2dd54462c65a469a2611be091d84fa71a4c1b5b61d020f4058296153941d9e13
Dridex
5998ba6bef4d61888a43213a75b78cdf13735906c5b9997f4d41958a513aed70
Dridex
7ce57a5b519458ee81cbb394a3cd50cb8840620e5b0a2451b587ed651b69288b
Dridex
cc31d1c3648d35d98c16d49ff17e290b07f431ccd23434b50c905c2aa4ba8f38
Dridex
ee1259ba7e41be5e8f11fb7ed2fb983bd9a48e757cf59690336aa63ac2497dba
Dridex
f2c2d92afa0f167bd54c763fc8fc3377bb6b9f1105b4bd0760c5a19018c41c3c
Dridex
fcdb7418de853985a97ec646304c172562701c5f34595eca6e5abe9dd1db66ca
Dridex
+ 5'434 additional samples on MalwareBazaar
Result
Malware family:
dridex
Create hunting rule
Score:
  10/10
Tags:
family:dridex botnet:22203 botnet loader
Link:
https://tria.ge/reports/211122-zr631scaa5/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Dridex Loader
Dridex
Malware Config
C2 Extraction:
67.207.95.35:443
86.107.98.232:8333
188.165.214.166:4664
144.91.110.219:9217
Unpacked files
SH256 hash:
c9a4621fd7c05fd84cdb4381789f16aee72635f116a5d5cca98b9d89e4069a9b
MD5 hash:
25e08102352d83395dbceb0445cb88d8
SHA1 hash:
9994341a7280113e0a09fbcd503a359b112d40dd
Detections:
win_dridex_auto
Create hunting rule
Link:
https://www.unpac.me/results/554ab405-bec4-4415-b898-8da0098bbf9c/
Parent samples :
cc31d1c3648d35d98c16d49ff17e290b07f431ccd23434b50c905c2aa4ba8f38
2dd54462c65a469a2611be091d84fa71a4c1b5b61d020f4058296153941d9e13
ee1259ba7e41be5e8f11fb7ed2fb983bd9a48e757cf59690336aa63ac2497dba
92a5ea2c1f1cc5177f54568b6d6b878f46a2bd3e49daf93f6385d304dcc1ee40
ba5fb468274de91023a4b8d14ff5b79a5531fed3cc818cdc93969b5fdb1a309d
b169abddcc96b1c9b61cd112734ad9e1d13af76ac9eb33b12c00fec870ed322d
2db0e926b1d6d60ab8138c008be5cad1ee2dda7a2cbbd27496953a97464b7511
8cb564d0a6548b35d96707b24a90ec361d82098f25381257fb8300ee5d27c6dc
106cd82325eacb5a9eedef1a7e54a9ad4e982469abe0b54583fbd4b8a0bd35f2
553cce1f64c0364094da5b64103f5bf184559eb9a4f7ebc5e14897b89ab6eda1
887f1d15b4c5a13871220261516df2fdb3410ed7a8b6088deee0d38610cbe68a
5aab487dfb1bd8c811dcc0fa8c9c9e762bb8df69424fd585d60a4bba53664599
ddcaa1c7ba38d83e0f34da7cce150905cd0246f15334b9feadd8dcab5cd991ee
b1029b6074fcc508c36bfd3c9c1ec582da3650faae2a9af1eb867ad3e05fc513
5cb8c6baf6d41a0dd663d092ebb31ef7bdaa4370fb0f8cb6fd35b6a8744f31c9
be193b9e9d20df4110f8da469af38bb99f445a173b13d1941da6be8d8c81d1fd
5092d010953226e366db6d47af4bf9886179ea6eb2655f3e70d4a1a82af1c7d5
SH256 hash:
d7adaa9c64927243f946cd1943f9f42b13ad76df24d8ea45dc7a0c3757f0bc33
MD5 hash:
45471be53672487eb05cc99480fef88b
SHA1 hash:
5b522c57cf878fdea2f4d8233a788cbb0069e830
Detections:
win_doppeldridex_auto
Create hunting rule
Link:
https://www.unpac.me/results/554ab405-bec4-4415-b898-8da0098bbf9c/
SH256 hash:
5cb8c6baf6d41a0dd663d092ebb31ef7bdaa4370fb0f8cb6fd35b6a8744f31c9
MD5 hash:
f3a6bac3b47e4dba8c9a05905e519a0a
SHA1 hash:
edebdd979430258f89db7bf02d9a2b653ed0f8f7
Link:
https://www.unpac.me/results/554ab405-bec4-4415-b898-8da0098bbf9c/
Malware family:
Dridex
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/5cb8c6baf6d4/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.14
Link:
https://yomi.yoroi.company/submissions/5cb8c6baf6d41a0dd663d092ebb31ef7bdaa4370fb0f8cb6fd35b6a8744f31c9

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DridexLoader
Create hunting rule
Author:kevoreilly
Description:Dridex v4 dropper C2 parsing function
Rule name:DridexV4
Create hunting rule
Author:kevoreilly
Description:Dridex v4 Payload
Rule name:dridex_loader
Create hunting rule
Author:kevoreilly
Description:Dridex Loader
Rule name:MALWARE_Win_DLLLoader
Create hunting rule
Author:ditekSHen
Description:Detects unknown DLL Loader
Rule name:win_doppeldridex_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.doppeldridex.
Rule name:win_dridex_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.dridex.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Dridex

DLL dll 5cb8c6baf6d41a0dd663d092ebb31ef7bdaa4370fb0f8cb6fd35b6a8744f31c9

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1806232/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/208438/

Comments