🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 85dd0bbdc1dde143ffd3906d04ce15fa415b0f66abfaeb1f3476007c5664438e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Dridex


Vendor detections: 10


Intelligence 10 IOCs YARA File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 85dd0bbdc1dde143ffd3906d04ce15fa415b0f66abfaeb1f3476007c5664438e
SHA3-384 hash: 013f7f7f48e0bce987166a3f4b58dbcae878900ca4ff887ba9442d35055c40165ff436f4e1030acdfe4dd43e35c3335a
SHA1 hash: d5f6aa91491a9188942acbabcc84ee8a19716c1f
MD5 hash: a0f8bce825cba9c9b9d23b8688333fd7
humanhash: friend-white-summer-september
File name:a0f8bce825cba9c9b9d23b8688333fd7
Download: download sample
Signature Dridex
Create hunting rule
File size:663'552 bytes
First seen:2021-11-17 19:09:30 UTC
Last seen:2021-11-17 21:11:02 UTC
File type:DLL dll
MIME type:application/x-dosexec
imphash fe16443ce39f2fcea9c5accdb27a9eac (21 x Dridex)
ssdeep 12288:/DTlJzJzJBJZn/JH3lJxJLJZJdPgA1VKBUA1rlldyJw:/DJtpDv/lVbdT3IA1wBUA1rlldyK
Threatray 5'346 similar samples on MalwareBazaar
TLSH T12CE48E0250D512FCFA898ABF155A67C1C6B310824ED1CB9E25CD07EADF64A03EE6D1B7
Reporter zbetcheckin
Tags:32 dll Dridex exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
129
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Detection(s):
SecuriteInfo.com.Suspicious.Win32.Save.a.21437.13368.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Сreating synchronization primitives
DNS request
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
67%
Tags:
packed
Link:
https://www.filescan.io/uploads/6195538b4912a8c920a1b994/reports/13a127c3-7ffe-498d-a2bd-5c92ad28e363/overview
Malware family:
Dridex
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/475ddf98-56b9-48ac-8c41-54b96d0731dd
Result
Threat name:
Dridex
Create hunting rule
Detection:
malicious
Classification:
troj
Score:
72 / 100
Link:
https://www.joesandbox.com/analysis/891474
Signature
C2 URLs / IPs found in malware configuration
Found malware configuration
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Yara detected Dridex unpacked file
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 523947 Sample: amYc2YMb76 Startdate: 17/11/2021 Architecture: WINDOWS Score: 72 18 54.37.70.105 OVHFR France 2->18 20 142.93.218.86 DIGITALOCEAN-ASNUS United States 2->20 22 2 other IPs or domains 2->22 26 Found malware configuration 2->26 28 Multi AV Scanner detection for submitted file 2->28 30 Yara detected Dridex unpacked file 2->30 32 2 other signatures 2->32 9 loaddll32.exe 1 2->9         started        signatures3 process4 process5 11 cmd.exe 1 9->11         started        process6 13 rundll32.exe 11->13         started        process7 15 WerFault.exe 23 9 13->15         started        dnsIp8 24 192.168.2.1 unknown unknown 15->24
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/85dd0bbdc1dde143ffd3906d04ce15fa415b0f66abfaeb1f3476007c5664438e/
Threat name:
Win32.Trojan.Drixed
Create hunting rule
Status:
Malicious
First seen:
2021-11-17 19:10:06 UTC
AV detection:
21 of 45 (46.67%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
doppeldridex
Create hunting rule
dridex
Create hunting rule
Similar samples:
2bf87021745923bb669cc6eda22bb54b5249f74f7e7e8a04ebc4f16b01a0a8c4
Dridex
32f0692da6367489eafc71602a1b075e177621e366101241206958a68318cf64
Dridex
33df285d24bac325fa5c56a08462a3ebf34904e4489abe7e6854f3f993ac033f
Dridex
3cba24dba02d5817a029caee6eadf1b3b4eb75ff861c62df3e4d4fbde1c349c2
Dridex
537866a96449444a54002776f34eecf053c23122a554a79f4743df0749aa8005
Dridex
770cb2aa5ea76f90e27bc72110b531fa3985ab4352d25362926971285408f148
Dridex
8536dd733f30a414cb8040e2d15631e1124942b150c75a2ef9178e61d2a75689
Dridex
9e99d5dbe3c26e4b87dc8b60414f9ba1c16c37b2c9672f5f184210c4a3404759
Dridex
a3abf81a46e3e318450f496e08d8cd0c9952f43deb4c481e19f9cfd36e884f2a
Dridex
+ 5'336 additional samples on MalwareBazaar
Result
Malware family:
dridex
Create hunting rule
Score:
  10/10
Tags:
family:dridex botnet:22203 botnet loader
Link:
https://tria.ge/reports/211117-xvc81adfh3/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Dridex Loader
Dridex
Malware Config
C2 Extraction:
54.37.70.105:443
198.199.70.22:6602
164.68.99.3:5007
142.93.218.86:4664
Unpacked files
SH256 hash:
2e4da7dbe3d43e07cf011302db7302f7b8d632d6823966ee620ae30cf34662e7
MD5 hash:
fffeb707e430160c6d8914689e04389b
SHA1 hash:
5537b9332c0efbfae10f9b433bb851959bd11cc7
Detections:
win_dridex_auto
Create hunting rule
Link:
https://www.unpac.me/results/cd2abfd4-3e98-451e-b828-b4a0a0aab016/
Parent samples :
8536dd733f30a414cb8040e2d15631e1124942b150c75a2ef9178e61d2a75689
32f0692da6367489eafc71602a1b075e177621e366101241206958a68318cf64
33df285d24bac325fa5c56a08462a3ebf34904e4489abe7e6854f3f993ac033f
a3abf81a46e3e318450f496e08d8cd0c9952f43deb4c481e19f9cfd36e884f2a
2bf87021745923bb669cc6eda22bb54b5249f74f7e7e8a04ebc4f16b01a0a8c4
85dd0bbdc1dde143ffd3906d04ce15fa415b0f66abfaeb1f3476007c5664438e
832cd5a0d475e0309f03bd6a00ae888e0be1c6a8585f9175e0dbe41d3fc960a6
233abb27be4c337cf8b9999c58b73e5890a61741c896e3afe8794b13d5652eb5
2c74a51c3843ccb411702e116ee7bf7c9efa3d53cbaf3709e789a6305a8ac67f
f81dcc275ffa54a53ed99e79aac49e274b1ce833b5c0c2fcfcb80a33da6e0408
b856b7bf0644dedaadccdc0c6b6c17edffb8d82abfac2db29e6107ecb8ae2912
be3eb491dd9953d6d06879a99357613f2a837f8a79a2ac3b67dfe7e6ce2bfdec
ad0a37a84fe23aa26337b1519c1208f5b2ada3d0ce4e0a6cbcceedf84f1222dc
d45df1bb669ebf3995005dd8e0c4a6999a776501cbca500182024b763b71cc1e
87ec152bfeda4a61988a9ade1dd1f45e2f39e7030b584be83de9da95d53a299e
6f2cb590bad8c42912576399c30686ffe95d28aee7adc9d0507335bb3d7e5824
dd8ac82effcb27eda36f0792d7ff5d50c66bca2c20386c5dd25565970f8234c2
c06e84c106ca78b1189aa03a7269ea76efd7879e3ef28a78ef9dcd5303328411
f1668c85b555e2c76538cbdd30418ccb6b29dc070456eee6bbfb14c55ba2244c
289bbd7c84e632bd35795623e60e1aea165eb25ebd20a6d979b7f01cf43eb0fd
7abfd89f20fc6b4d28c95fd22a977fbc247438071fdb6710fe24487d571c3314
SH256 hash:
f1ed52ad87b26e0c211f46fcd725d86105c38f958770820f0ee328540551adef
MD5 hash:
b6e05912e6e76d6c6965d89370557be6
SHA1 hash:
319900317d20bcb9cda18c596abe1795d9a470f9
Detections:
win_doppeldridex_auto
Create hunting rule
Link:
https://www.unpac.me/results/cd2abfd4-3e98-451e-b828-b4a0a0aab016/
Parent samples :
85dd0bbdc1dde143ffd3906d04ce15fa415b0f66abfaeb1f3476007c5664438e
832cd5a0d475e0309f03bd6a00ae888e0be1c6a8585f9175e0dbe41d3fc960a6
2c74a51c3843ccb411702e116ee7bf7c9efa3d53cbaf3709e789a6305a8ac67f
c06e84c106ca78b1189aa03a7269ea76efd7879e3ef28a78ef9dcd5303328411
SH256 hash:
85dd0bbdc1dde143ffd3906d04ce15fa415b0f66abfaeb1f3476007c5664438e
MD5 hash:
a0f8bce825cba9c9b9d23b8688333fd7
SHA1 hash:
d5f6aa91491a9188942acbabcc84ee8a19716c1f
Link:
https://www.unpac.me/results/cd2abfd4-3e98-451e-b828-b4a0a0aab016/
Malware family:
Dridex
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/85dd0bbdc1dd/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Trojan
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/85dd0bbdc1dde143ffd3906d04ce15fa415b0f66abfaeb1f3476007c5664438e

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Dridex

DLL dll 85dd0bbdc1dde143ffd3906d04ce15fa415b0f66abfaeb1f3476007c5664438e

(this sample)

  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/206968/

Comments


Avatar
zbet commented on 2021-11-17 19:09:32 UTC

url : hxxps://api.onedrive.com/v1.0/shares/u!aHR0cHM6Ly9vbmVkcml2ZS5saXZlLmNvbS9lbWJlZD9yZXNpZD04RUM3QzYyQTdDMkY5OThGJTIxMTA1JmF1dGhrZXk9IUFCVUJ2dXdBRnNDOVlPTQ/root/content/