🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 832cd5a0d475e0309f03bd6a00ae888e0be1c6a8585f9175e0dbe41d3fc960a6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Dridex


Vendor detections: 11


Intelligence 11 IOCs YARA 6 File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 832cd5a0d475e0309f03bd6a00ae888e0be1c6a8585f9175e0dbe41d3fc960a6
SHA3-384 hash: 7d8af3d38cebfb15d106c6bcd49b1be319853f349cfea09b19e28b95d7b554648f34cc5f22b0dd163c9c2e384a4e8a07
SHA1 hash: 1b79f4b4932f9e0cdbcd6de6510420efbd19e870
MD5 hash: b4c5c1e150afcd7386e83ef0da203f3b
humanhash: papa-twenty-island-west
File name:b4c5c1e150afcd7386e83ef0da203f3b
Download: download sample
Signature Dridex
Create hunting rule
File size:663'552 bytes
First seen:2021-11-17 20:12:19 UTC
Last seen:2021-11-18 05:54:49 UTC
File type:DLL dll
MIME type:application/x-dosexec
imphash fe16443ce39f2fcea9c5accdb27a9eac (21 x Dridex)
ssdeep 12288:JHTlJzJzJBJZn/JH3lJxJLJZJdPgA1VKBUA1rlldqJw:JHJtpDv/lVbdT3IA1wBUA1rlldqK
Threatray 5'349 similar samples on MalwareBazaar
TLSH T14CE48E0250D512FCFA898ABF155A67C1C6B310824ED1CB9E25CD07EADF64A03EE6D1B7
Reporter zbetcheckin
Tags:32 dll Dridex exe

Intelligence

File Origin
# of uploads :
3
# of downloads :
145
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Detection(s):
SecuriteInfo.com.Drixed-FJXB4C5C1E150AF.17128.14243.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Searching for the window
Сreating synchronization primitives
DNS request
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
67%
Tags:
packed
Link:
https://www.filescan.io/uploads/6195625043e8f62b66978b00/reports/a0845d04-38e4-4be2-ad85-9e3db46b5e82/overview
Malware family:
Dridex
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/b3430fa9-148d-4721-b573-e9588c4261aa
Result
Threat name:
Dridex
Create hunting rule
Detection:
malicious
Classification:
troj
Score:
76 / 100
Link:
https://www.joesandbox.com/analysis/891503
Signature
C2 URLs / IPs found in malware configuration
Found malware configuration
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Sigma detected: Copying Sensitive Files with Credential Data
Yara detected Dridex unpacked file
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 523976 Sample: 7zBsVSsEM6 Startdate: 17/11/2021 Architecture: WINDOWS Score: 76 17 54.37.70.105 OVHFR France 2->17 19 142.93.218.86 DIGITALOCEAN-ASNUS United States 2->19 21 2 other IPs or domains 2->21 23 Found malware configuration 2->23 25 Multi AV Scanner detection for submitted file 2->25 27 Yara detected Dridex unpacked file 2->27 29 3 other signatures 2->29 9 loaddll32.exe 1 2->9         started        signatures3 process4 process5 11 cmd.exe 1 9->11         started        process6 13 rundll32.exe 11->13         started        process7 15 WerFault.exe 23 9 13->15         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/832cd5a0d475e0309f03bd6a00ae888e0be1c6a8585f9175e0dbe41d3fc960a6/
Threat name:
Win32.Trojan.GenericML
Create hunting rule
Status:
Malicious
First seen:
2021-11-17 20:13:05 UTC
AV detection:
14 of 28 (50.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=qmwnliguoxqdbhydxvvabluiryf6drvilbpzc5pa3psb2p6jmcta._file
Verdict:
malicious
Label(s):
doppeldridex
Create hunting rule
dridex
Create hunting rule
Similar samples:
233abb27be4c337cf8b9999c58b73e5890a61741c896e3afe8794b13d5652eb5
Dridex
2bf87021745923bb669cc6eda22bb54b5249f74f7e7e8a04ebc4f16b01a0a8c4
Dridex
32f0692da6367489eafc71602a1b075e177621e366101241206958a68318cf64
Dridex
33df285d24bac325fa5c56a08462a3ebf34904e4489abe7e6854f3f993ac033f
Dridex
3cba24dba02d5817a029caee6eadf1b3b4eb75ff861c62df3e4d4fbde1c349c2
Dridex
537866a96449444a54002776f34eecf053c23122a554a79f4743df0749aa8005
Dridex
8536dd733f30a414cb8040e2d15631e1124942b150c75a2ef9178e61d2a75689
Dridex
85dd0bbdc1dde143ffd3906d04ce15fa415b0f66abfaeb1f3476007c5664438e
Dridex
a3abf81a46e3e318450f496e08d8cd0c9952f43deb4c481e19f9cfd36e884f2a
Dridex
+ 5'339 additional samples on MalwareBazaar
Result
Malware family:
dridex
Create hunting rule
Score:
  10/10
Tags:
family:dridex botnet:22203 botnet loader
Link:
https://tria.ge/reports/211117-yzehasdhb2/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Dridex Loader
Dridex
Malware Config
C2 Extraction:
54.37.70.105:443
198.199.70.22:6602
164.68.99.3:5007
142.93.218.86:4664
Unpacked files
SH256 hash:
2e4da7dbe3d43e07cf011302db7302f7b8d632d6823966ee620ae30cf34662e7
MD5 hash:
fffeb707e430160c6d8914689e04389b
SHA1 hash:
5537b9332c0efbfae10f9b433bb851959bd11cc7
Detections:
win_dridex_auto
Create hunting rule
Link:
https://www.unpac.me/results/c7e671e8-88d7-49fd-8f4c-fe6f4409bfc2/
Parent samples :
8536dd733f30a414cb8040e2d15631e1124942b150c75a2ef9178e61d2a75689
32f0692da6367489eafc71602a1b075e177621e366101241206958a68318cf64
33df285d24bac325fa5c56a08462a3ebf34904e4489abe7e6854f3f993ac033f
a3abf81a46e3e318450f496e08d8cd0c9952f43deb4c481e19f9cfd36e884f2a
2bf87021745923bb669cc6eda22bb54b5249f74f7e7e8a04ebc4f16b01a0a8c4
85dd0bbdc1dde143ffd3906d04ce15fa415b0f66abfaeb1f3476007c5664438e
832cd5a0d475e0309f03bd6a00ae888e0be1c6a8585f9175e0dbe41d3fc960a6
233abb27be4c337cf8b9999c58b73e5890a61741c896e3afe8794b13d5652eb5
2c74a51c3843ccb411702e116ee7bf7c9efa3d53cbaf3709e789a6305a8ac67f
f81dcc275ffa54a53ed99e79aac49e274b1ce833b5c0c2fcfcb80a33da6e0408
b856b7bf0644dedaadccdc0c6b6c17edffb8d82abfac2db29e6107ecb8ae2912
be3eb491dd9953d6d06879a99357613f2a837f8a79a2ac3b67dfe7e6ce2bfdec
ad0a37a84fe23aa26337b1519c1208f5b2ada3d0ce4e0a6cbcceedf84f1222dc
d45df1bb669ebf3995005dd8e0c4a6999a776501cbca500182024b763b71cc1e
87ec152bfeda4a61988a9ade1dd1f45e2f39e7030b584be83de9da95d53a299e
6f2cb590bad8c42912576399c30686ffe95d28aee7adc9d0507335bb3d7e5824
dd8ac82effcb27eda36f0792d7ff5d50c66bca2c20386c5dd25565970f8234c2
c06e84c106ca78b1189aa03a7269ea76efd7879e3ef28a78ef9dcd5303328411
f1668c85b555e2c76538cbdd30418ccb6b29dc070456eee6bbfb14c55ba2244c
289bbd7c84e632bd35795623e60e1aea165eb25ebd20a6d979b7f01cf43eb0fd
7abfd89f20fc6b4d28c95fd22a977fbc247438071fdb6710fe24487d571c3314
SH256 hash:
f1ed52ad87b26e0c211f46fcd725d86105c38f958770820f0ee328540551adef
MD5 hash:
b6e05912e6e76d6c6965d89370557be6
SHA1 hash:
319900317d20bcb9cda18c596abe1795d9a470f9
Detections:
win_doppeldridex_auto
Create hunting rule
Link:
https://www.unpac.me/results/c7e671e8-88d7-49fd-8f4c-fe6f4409bfc2/
Parent samples :
85dd0bbdc1dde143ffd3906d04ce15fa415b0f66abfaeb1f3476007c5664438e
832cd5a0d475e0309f03bd6a00ae888e0be1c6a8585f9175e0dbe41d3fc960a6
2c74a51c3843ccb411702e116ee7bf7c9efa3d53cbaf3709e789a6305a8ac67f
c06e84c106ca78b1189aa03a7269ea76efd7879e3ef28a78ef9dcd5303328411
SH256 hash:
832cd5a0d475e0309f03bd6a00ae888e0be1c6a8585f9175e0dbe41d3fc960a6
MD5 hash:
b4c5c1e150afcd7386e83ef0da203f3b
SHA1 hash:
1b79f4b4932f9e0cdbcd6de6510420efbd19e870
Link:
https://www.unpac.me/results/c7e671e8-88d7-49fd-8f4c-fe6f4409bfc2/
Malware family:
Dridex
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/832cd5a0d475/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Trojan
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/832cd5a0d475e0309f03bd6a00ae888e0be1c6a8585f9175e0dbe41d3fc960a6

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DridexLoader
Create hunting rule
Author:kevoreilly
Description:Dridex v4 dropper C2 parsing function
Rule name:DridexV4
Create hunting rule
Author:kevoreilly
Description:Dridex v4 Payload
Rule name:dridex_loader
Create hunting rule
Author:kevoreilly
Description:Dridex Loader
Rule name:MALWARE_Win_DLLLoader
Create hunting rule
Author:ditekSHen
Description:Detects unknown DLL Loader
Rule name:win_doppeldridex_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.doppeldridex.
Rule name:win_dridex_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.dridex.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Dridex

DLL dll 832cd5a0d475e0309f03bd6a00ae888e0be1c6a8585f9175e0dbe41d3fc960a6

(this sample)

  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/206972/
  
URLhaus
https://urlhaus.abuse.ch/url/1798178/
  
URLhaus
https://urlhaus.abuse.ch/url/1798926/

Comments


Avatar
zbet commented on 2021-11-17 20:12:20 UTC

url : hxxps://8pvf3q.am.files.1drv.com/y4m6EKFpIviXUGP2_ENZKpvwHId5_jjgN_0jZVcawwZZch4qxE1V5YPou59X_hDZRzQvazNYX8w_U_G0GTEu4YA380d81FWj5dgg33LRGAAIuuzmbUk2tSYDDtelU7JjuS18xWAiDts0yhCeFndNy3xxgSfyS_CHWyEB96hiapvjiU9A_mY2B3tYN56hMolUMXyK892p7W49kmRMgMIOUbl9Q/quodqbqhlcvhzw.mp4