🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 673ff75f1fc774b6bf83689e9394b17587c795611b3ef2dae9c865bf6949d344. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Dridex


Vendor detections: 11


Intelligence 11 IOCs YARA 6 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 673ff75f1fc774b6bf83689e9394b17587c795611b3ef2dae9c865bf6949d344
SHA3-384 hash: fda4d948793d49b3ee952c9b8a0aeb3e6e6f94dccee09c6e05e63756662ee9cc70d46eb0b578a1426e951f60d6716592
SHA1 hash: 7a14db7cd4b76d1eccadca39ca483e33f0c31741
MD5 hash: 5f87499f31070c6147d7e3961bef7234
humanhash: vegan-arkansas-river-four
File name:SecuriteInfo.com.W32.Dridex.GB.genEldorado.9932.21995
Download: download sample
Signature Dridex
Create hunting rule
File size:520'192 bytes
First seen:2021-12-21 03:05:51 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash 2b1b4edc6ebe7eca63696f6220126258 (7 x Dridex)
ssdeep 6144:75a3RjZ1XrZvR7Z9JrZdR5ZbR1Z9RVZ1RvZpR17fRrZpRrTZRfZ3Rr3fRJZfRlZ7:ebTFRJXfZrFTfVBokoa7fGs8s7l
Threatray 5'732 similar samples on MalwareBazaar
TLSH T111B48E29E83826A4FC351F3875E0B3CEB653D9145B3B81707B7D9B348782991ECA61C6
Reporter SecuriteInfoCom
Tags:dll Dridex

Intelligence

File Origin
# of uploads :
1
# of downloads :
642
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.W32.Dridex.GB.genEldorado.9932.21995.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
DNS request
Sending a custom TCP request
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
67%
Tags:
dridex packed
Link:
https://www.filescan.io/uploads/61c1449eec6c6c14a9e68555/reports/fb87b88c-8173-4184-b901-74688982a440/overview
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/77a56d96-6272-43ea-bfd1-d90003bbe0d2
Result
Threat name:
Dridex
Create hunting rule
Detection:
malicious
Classification:
troj
Score:
76 / 100
Link:
https://www.joesandbox.com/analysis/910727
Signature
C2 URLs / IPs found in malware configuration
Found malware configuration
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Sigma detected: Suspicious Call by Ordinal
Yara detected Dridex unpacked file
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 543202 Sample: SecuriteInfo.com.W32.Dridex... Startdate: 21/12/2021 Architecture: WINDOWS Score: 76 17 93.104.209.107 MNET-ASGermanyDE Germany 2->17 19 144.91.122.100 CONTABODE Germany 2->19 21 2 other IPs or domains 2->21 23 Found malware configuration 2->23 25 Multi AV Scanner detection for submitted file 2->25 27 Yara detected Dridex unpacked file 2->27 29 3 other signatures 2->29 9 loaddll32.exe 1 2->9         started        signatures3 process4 process5 11 cmd.exe 1 9->11         started        process6 13 rundll32.exe 11->13         started        process7 15 WerFault.exe 23 9 13->15         started       
Detection:
dridex
Create hunting rule
Link:
https://mwdb.cert.pl/sample/673ff75f1fc774b6bf83689e9394b17587c795611b3ef2dae9c865bf6949d344/
Threat name:
Win32.Worm.Cridex
Create hunting rule
Status:
Malicious
First seen:
2021-12-20 20:24:02 UTC
File Type:
PE (Dll)
AV detection:
21 of 43 (48.84%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=m477oxy7y52lnp4dncpjhffrowd4pflbdm7pfwxjzbs362kj2nca._file
Verdict:
malicious
Label(s):
doppeldridex
Create hunting rule
dridex
Create hunting rule
Similar samples:
2b25238c00aa0596c7132d869b2a208803a51c22b76e9b22562f930be4d1a17b
Dridex
42a44e52c0b4d3105ce3f46b7ce7bd30eb24c9b320823e1c25d7ca37f1cf32f8
Dridex
594bb2ed8db58f342ea2a9a6cd9f87b102b78538e2e45757a6fa0c83b37b4b38
Dridex
9a92587563a7be70787c52f46a5bbd5240cf012ba5ec77e23d04bda3d652a9c7
Dridex
c4ee2acc6b5aca21235917972c19d30c5585662b59decc6994c54d51bf5d5b80
Dridex
ce02033f92d2acef752f129963acc1e34a00521ad120258685cc52f98b3a603e
Dridex
+ 5'722 additional samples on MalwareBazaar
Result
Malware family:
dridex
Create hunting rule
Score:
  10/10
Tags:
family:dridex botnet:22201 botnet loader
Link:
https://tria.ge/reports/211221-dlrv9achgq/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Dridex Loader
Dridex
Malware Config
C2 Extraction:
144.91.122.100:443
188.214.241.242:4664
93.104.209.107:8116
5.189.190.214:593
Unpacked files
SH256 hash:
4684ab52e72e1eb6135489da64d5f4a321c2ad0ee04e2fc8c14b56eda765ddc8
MD5 hash:
54d04eb51705579cc1219f7209a84a84
SHA1 hash:
a6cab81c2570e2f180bad49d96f620baacf82a70
Detections:
win_doppeldridex_auto
Create hunting rule
Link:
https://www.unpac.me/results/f48e093c-fc4f-4082-841d-822c5320a26f/
SH256 hash:
4d620a0cd0b47ed20c05c3b96c938d050941f2e2627a9bf088ac8634af7ea4b6
MD5 hash:
ad50cb79d9abe9bf03b81cc1e54b10bf
SHA1 hash:
8b731c9ad3c37461338a4140a1700f4e36baf05f
Detections:
win_dridex_auto
Create hunting rule
Link:
https://www.unpac.me/results/f48e093c-fc4f-4082-841d-822c5320a26f/
Parent samples :
594bb2ed8db58f342ea2a9a6cd9f87b102b78538e2e45757a6fa0c83b37b4b38
9a92587563a7be70787c52f46a5bbd5240cf012ba5ec77e23d04bda3d652a9c7
145b6b65c2627e10b663d7f1609ff56380262d9dc8850b7ac31cb3ee4feb511d
94a784a5377541aa2f994182ff9308cc1265938088aa87a2a1d3198f29509793
a4b602ad5624c7570395c8d61fb558727f2e37ce763377d0ddeb93b176b592fb
673ff75f1fc774b6bf83689e9394b17587c795611b3ef2dae9c865bf6949d344
2b25238c00aa0596c7132d869b2a208803a51c22b76e9b22562f930be4d1a17b
SH256 hash:
673ff75f1fc774b6bf83689e9394b17587c795611b3ef2dae9c865bf6949d344
MD5 hash:
5f87499f31070c6147d7e3961bef7234
SHA1 hash:
7a14db7cd4b76d1eccadca39ca483e33f0c31741
Link:
https://www.unpac.me/results/f48e093c-fc4f-4082-841d-822c5320a26f/
Malware family:
Dridex
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/673ff75f1fc7/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.96
Link:
https://yomi.yoroi.company/submissions/673ff75f1fc774b6bf83689e9394b17587c795611b3ef2dae9c865bf6949d344

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DridexLoader
Create hunting rule
Author:kevoreilly
Description:Dridex v4 dropper C2 parsing function
Rule name:DridexV4
Create hunting rule
Author:kevoreilly
Description:Dridex v4 Payload
Rule name:dridex_loader
Create hunting rule
Author:kevoreilly
Description:Dridex Loader
Rule name:MALWARE_Win_DLLLoader
Create hunting rule
Author:ditekSHen
Description:Detects unknown DLL Loader
Rule name:win_doppeldridex_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.doppeldridex.
Rule name:win_dridex_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.dridex.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Dridex

DLL dll 673ff75f1fc774b6bf83689e9394b17587c795611b3ef2dae9c865bf6949d344

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1905129/
  
Delivery method
Distributed via web download

Comments