MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 6158375fa9e56105f92dd0b703cae796ad163906b83506b6e2e7c8a6348757fe. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Dridex
Vendor detections: 12
| SHA256 hash: | 6158375fa9e56105f92dd0b703cae796ad163906b83506b6e2e7c8a6348757fe |
|---|---|
| SHA3-384 hash: | e4a94e4574d67c371bbd727185ae5bc90eed079e8e7e402388622e0834cebc6fd67f09eda402252b9380aa83b0ae40e0 |
| SHA1 hash: | 5ace338282107a131e14fcf226844010518190fd |
| MD5 hash: | 6a43624a01c4463c9bfbc2035a3efcec |
| humanhash: | lima-asparagus-river-kilo |
| File name: | GjEdowscAmeMpshekniggagook.flac |
| Download: | download sample |
| Signature | Dridex |
| File size: | 443'240 bytes |
| First seen: | 2021-11-22 16:36:03 UTC |
| Last seen: | Never |
| File type: |  dll |
| MIME type: | application/x-dosexec |
| imphash | ade3320a9abdb122f69116c8d1965088 (3 x Dridex) |
| ssdeep | 12288:/YRZGRlYRbGFbwRb+0tWNTtW4Y9MlimzQB9/WyNPfQr0/Lq1tz2L9Cm3Lea1/0Rf:/Ys2IEq0tkT3v |
| Threatray | 5'435 similar samples on MalwareBazaar |
| TLSH | T16E94D090A2984FD6F356AD7EF979163E2C00617286A91EE0310856F5E41F8FBF236077 |
| Reporter |  proxylife |
| Tags: | dll Dridex signed |
Code Signing Certificate
| Organisation: | STAND ALONE MUSIC LTD |
|---|---|
| Issuer: | Sectigo RSA Code Signing CA |
| Algorithm: | sha256WithRSAEncryption |
| Valid from: | 2020-12-07T00:00:00Z |
| Valid to: | 2021-12-07T23:59:59Z |
| Serial number: | 3b777165b125bccc181d0bac3f5b55b3 |
| Intelligence: | 55 malware samples on MalwareBazaar are signed with this code signing certificate |
| MalwareBazaar Blocklist: | This certificate is on the MalwareBazaar code signing certificate blocklist (CSCB) |
| Thumbprint Algorithm: | SHA256 |
| Thumbprint: | f680fab6a9d21e8e76003c5c28b3c5084866d7ac85cf0cfb5aaa02f69ee99f1e |
| Source: | This information was brought to you by ReversingLabs A1000 Malware Analysis Platform |
Intelligence
File Origin
# of uploads :
1
# of downloads :
149
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Result
Verdict:
Malware
Maliciousness:
Behaviour
Сreating synchronization primitives
DNS request
Verdict:
Suspicious
Threat level:
5/10
Confidence:
100%
Tags:
overlay packed
Malware family:
Dridex
Verdict:
Malicious
Result
Threat name:
Dridex
Detection:
malicious
Classification:
troj.evad
Score:
72 / 100
Signature
C2 URLs / IPs found in malware configuration
Found malware configuration
Multi AV Scanner detection for submitted file
Tries to delay execution (extensive OutputDebugStringW loop)
Yara detected Dridex unpacked file
Behaviour
Behavior Graph:
Threat name:
Win32.Trojan.Drixed
Status:
Malicious
First seen:
2021-11-22 16:37:13 UTC
File Type:
PE (Dll)
AV detection:
29 of 45 (64.44%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Label(s):
doppeldridex
dridex
Similar samples:
+ 5'425 additional samples on MalwareBazaar
Result
Malware family:
dridex
Score:
10/10
Tags:
family:dridex botnet:22201 botnet loader
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Dridex Loader
Dridex
Malware Config
C2 Extraction:
67.207.95.35:443
86.107.98.232:8333
188.165.214.166:4664
144.91.110.219:9217
86.107.98.232:8333
188.165.214.166:4664
144.91.110.219:9217
Unpacked files
SH256 hash:
4d6884b73e08b17b7af972b813800479c95de3ef9c0a859874c114a351249ae8
MD5 hash:
26a3f823c8a31792b49b57916f11096e
SHA1 hash:
589d57ab82658140fba886e52f4d8e9a6d0610f7
Detections:
win_dridex_auto
SH256 hash:
7beb75fa48e846db343e797079759c243308942ab54caa9e99711e692acaae07
MD5 hash:
074081ce653e5f0031e3c4ead035ecf9
SHA1 hash:
957ed27be358c007d22fa4e385d50ff7bee79a9e
Detections:
win_doppeldridex_auto
SH256 hash:
6158375fa9e56105f92dd0b703cae796ad163906b83506b6e2e7c8a6348757fe
MD5 hash:
6a43624a01c4463c9bfbc2035a3efcec
SHA1 hash:
5ace338282107a131e14fcf226844010518190fd
Malware family:
Dridex
Verdict:
Malicious
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Dridex
Score:
0.90
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | DridexLoader |
|---|---|
| Author: | kevoreilly |
| Description: | Dridex v4 dropper C2 parsing function |
| Rule name: | DridexV4 |
|---|---|
| Author: | kevoreilly |
| Description: | Dridex v4 Payload |
| Rule name: | dridex_loader |
|---|---|
| Author: | kevoreilly |
| Description: | Dridex Loader |
| Rule name: | MALWARE_Win_DLLLoader |
|---|---|
| Author: | ditekSHen |
| Description: | Detects unknown DLL Loader |
| Rule name: | Sectigo_Code_Signed |
|---|---|
| Description: | Detects code signed by the Sectigo RSA Code Signing CA |
| Reference: | https://bazaar.abuse.ch/export/csv/cscb/ |
| Rule name: | Sectigo_Code_Signed |
|---|---|
| Description: | Detects code signed by the Sectigo RSA Code Signing CA |
| Reference: | https://bazaar.abuse.ch/export/csv/cscb/ |
| Rule name: | win_doppeldridex_auto |
|---|---|
| Author: | Felix Bilstein - yara-signator at cocacoding dot com |
| Description: | Detects win.doppeldridex. |
| Rule name: | win_dridex_auto |
|---|---|
| Author: | Felix Bilstein - yara-signator at cocacoding dot com |
| Description: | Detects win.dridex. |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Web download
Delivery method
Distributed via web download
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.