🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 87d2c1489a831b10ed176efb8a1bb73657418e4f332d6de0e10fa0f21c71fa11. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Dridex


Vendor detections: 11


Intelligence 11 IOCs YARA 6 File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 87d2c1489a831b10ed176efb8a1bb73657418e4f332d6de0e10fa0f21c71fa11
SHA3-384 hash: c395081d7add43430a4b7a52a8d5cf3443231ff0b28da7b37987b871a85c5acdd72e7fc236b525894fa4ece3e3b0d6d0
SHA1 hash: 308dea444f274e72b83bf538a79fde8d73753a81
MD5 hash: 92cd02f630a8576c9ee0e96bc8286c18
humanhash: solar-magazine-fillet-edward
File name:92cd02f630a8576c9ee0e96bc8286c18
Download: download sample
Signature Dridex
Create hunting rule
File size:630'784 bytes
First seen:2021-12-04 01:36:29 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash a8216198551e5fea52de18ae98283824 (33 x Dridex)
ssdeep 12288:2ZENU3sDifTQzSb4rRrV6dVk/VQ/VE/VF5CiiN5Pulv2c7eaciuSam:2WOc+U+kNh6rkdQdEdF5NiN5g7eaciuJ
Threatray 5'518 similar samples on MalwareBazaar
TLSH T145D48E2C340E2119F41A38BA3B1A71F3FBE63EE065AFD8578E8424F22F466E145B4175
Reporter zbetcheckin
Tags:32 dll Dridex exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
183
Origin country :
n/a
Vendor Threat Intelligence
Detection:
DridexV4
Create hunting rule
Link:
https://www.capesandbox.com/analysis/211171/
Detection(s):
SecuriteInfo.com.Trojan.Dridex.827.24865.26692.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
DNS request
Sending a custom TCP request
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/61aac6414d8e6f3a5e0e7762/reports/1b76a8d4-ef5c-4592-9c96-5ff412ae850f/overview
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/b1a7e68b-4d52-41ab-9616-d0e750f311c0
Result
Threat name:
Dridex
Create hunting rule
Detection:
malicious
Classification:
troj
Score:
72 / 100
Link:
https://www.joesandbox.com/analysis/901246
Signature
C2 URLs / IPs found in malware configuration
Found malware configuration
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Yara detected Dridex unpacked file
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 533724 Sample: KzqYwdKsJa Startdate: 04/12/2021 Architecture: WINDOWS Score: 72 21 185.4.135.165 TOPHOSTGR Greece 2->21 23 149.56.106.83 OVHFR Canada 2->23 25 3 other IPs or domains 2->25 27 Found malware configuration 2->27 29 Multi AV Scanner detection for submitted file 2->29 31 Yara detected Dridex unpacked file 2->31 33 2 other signatures 2->33 9 loaddll32.exe 1 2->9         started        signatures3 process4 process5 11 cmd.exe 1 9->11         started        13 rundll32.exe 9->13         started        process6 15 rundll32.exe 11->15         started        17 WerFault.exe 9 13->17         started        process7 19 WerFault.exe 23 9 15->19         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/87d2c1489a831b10ed176efb8a1bb73657418e4f332d6de0e10fa0f21c71fa11/
Threat name:
Win32.Trojan.Drixed
Create hunting rule
Status:
Malicious
First seen:
2021-12-02 02:31:03 UTC
File Type:
PE (Dll)
AV detection:
30 of 45 (66.67%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=q7jmcse2qmnrb3ixn35yug5xgzluddspgmww3yhbb6qpehdr7iiq._file
Verdict:
malicious
Label(s):
doppeldridex
Create hunting rule
dridex
Create hunting rule
Similar samples:
3f93bbbd31f1ca5627326b08e3fdffeed857a43e0800fb2e0503065adf42be30
Dridex
583de1b712e2bbbfd876553c385129f316bbfa46c0033b07d886a076bb3a3553
Dridex
5def0b736bef3857c2b741e5fa0a4f179736a1d8d1fc3941d6707a6807381763
Dridex
84f37808396aa0fb587bac76d4322a27532c8ca5fb9a7c76492ea84d162e3310
Dridex
99e042854717f6de443e055534c7513b106f7904f320afc5385660a50e7a61ff
Dridex
+ 5'508 additional samples on MalwareBazaar
Result
Malware family:
dridex
Create hunting rule
Score:
  10/10
Tags:
family:dridex botnet:22201 botnet loader
Link:
https://tria.ge/reports/211204-b1tx2scfa4/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Dridex Loader
Dridex
Malware Config
C2 Extraction:
149.56.106.83:443
45.79.248.254:2222
144.91.110.55:3978
94.177.217.88:808
185.4.135.165:5228
Unpacked files
SH256 hash:
aa2c29d94a3d3b6549feb232c74712ad39163599efc9932c4daab57d0fd9922b
MD5 hash:
91238674af8664eb68b35ec21d3b0673
SHA1 hash:
bf3ea11bffaab4804ec40f9492fe022148814297
Detections:
win_dridex_auto
Create hunting rule
Link:
https://www.unpac.me/results/130ba3a6-ea62-49d4-b996-0a1ccd6664c6/
Parent samples :
b61f624589d5ad3584e09f3174f8e3e1ac38958f260eee526b0abaf7389d7932
99e042854717f6de443e055534c7513b106f7904f320afc5385660a50e7a61ff
aef59db50378667cff8b3181421445c59a27932d835d47f016a879ced1f04dd7
5def0b736bef3857c2b741e5fa0a4f179736a1d8d1fc3941d6707a6807381763
12fe5d80d324fde6ef3235b1054f24356bccf8f72a7b79b555dac06b97342403
d2c0aec06c46b34adf7d3ef03a429ba9d002775e851e59e74cc64f413d695dec
5e4474540d6a18cc234d6c831514de5e027fa2907595ec4f22a0399eb492f88b
63be890e8b157de3ae4dca164818c94d823e777b40de79fea99f3177a5533ee9
2331c1ea9b61002e8f00e678780de6be847e638ebd28bab6f045c3fbe9984a14
84d95cbc8969a22550309b3eb3633b78d48b29ca4d825314056f0e66823739cc
5de057704e2a85cfff7e44ad451325c7e56cdf11a43fd0a1432a8f7a650b054b
583de1b712e2bbbfd876553c385129f316bbfa46c0033b07d886a076bb3a3553
3f93bbbd31f1ca5627326b08e3fdffeed857a43e0800fb2e0503065adf42be30
84f37808396aa0fb587bac76d4322a27532c8ca5fb9a7c76492ea84d162e3310
1d29ecde092f21ea0dd05b9f42531be1ed2207d6ebb9b463517f4c9508ff24a7
b7b3714d0714371522f28baf997ae78c34c8980d7b77a6600924719c4b2b037f
28d50aa5fc2ee8f16cc698d816c64ef79ed9d98587ae6816539e897773414024
87d2c1489a831b10ed176efb8a1bb73657418e4f332d6de0e10fa0f21c71fa11
b9d822c23278d5546fb225ac08f5a72231248ef27c38242f06f0495940790481
548a04fdd00a3327c6423736783d260c34ded9aa47c3c4abc29df2a128aa1b74
5fab3822f3842905d42d1b14a0c0f67336e40cf789393e3d59b8a68bf9f19feb
65858cba029d03cff70d8b54050523a1cd8b8b0f7cabfbd631944349d7b4a8cd
4b5065bfdc821c77eae5d00c1f526cde579eb5688649baa48931a6879565571a
ad4637ebab9999270e5ea2c82695c3abde792a54a2e7fd5b990ded043620049e
e3dc89c3cbb368c868c5332e768a6ccac0444d3e5f077790aac31f88691b9509
f0dd04098975f1c5de71209f9a7233295eee2cc30804fbbbcdc1dbc9bc00abb5
1ca9365813fc56e27b3a2fad0a6abc8268252593a89b3d8d9d699e6042f33fdf
9997b58e5e99a5f016f637d17b183f82e769d25484fb07aa6ec4cc102e42e6e0
10c879702701823effd064a5a7fa817010b404c40625b146778f309269bfd157
64a15ab0a90083db4b995d933d3897b3523f1893530c2ecea7e78977ff03ccd2
ff897c52402c287c5a895d4626ef9b4f6bdd5b125723d2db7db48b1a43cd2bb0
5e105744ba049ea2e8395b2059b8339f3b98af884c0d9c3e1496601c5d1bf93b
34990ad80292142c3cf0706eef7b76697fa17c684064085c5d166b8bc292618d
SH256 hash:
2e6c318ab22edc271e5f36b33cbec1cb9730f7d359277c35e278e9ff96946d82
MD5 hash:
f4b693f19984212c636c9ac843281e54
SHA1 hash:
ba20112352740f106e3995bcbcb57cbb24671054
Detections:
win_doppeldridex_auto
Create hunting rule
Link:
https://www.unpac.me/results/130ba3a6-ea62-49d4-b996-0a1ccd6664c6/
SH256 hash:
87d2c1489a831b10ed176efb8a1bb73657418e4f332d6de0e10fa0f21c71fa11
MD5 hash:
92cd02f630a8576c9ee0e96bc8286c18
SHA1 hash:
308dea444f274e72b83bf538a79fde8d73753a81
Link:
https://www.unpac.me/results/130ba3a6-ea62-49d4-b996-0a1ccd6664c6/
Malware family:
Dridex
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/87d2c1489a83/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/87d2c1489a831b10ed176efb8a1bb73657418e4f332d6de0e10fa0f21c71fa11

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DridexLoader
Create hunting rule
Author:kevoreilly
Description:Dridex v4 dropper C2 parsing function
Rule name:DridexV4
Create hunting rule
Author:kevoreilly
Description:Dridex v4 Payload
Rule name:dridex_loader
Create hunting rule
Author:kevoreilly
Description:Dridex Loader
Rule name:MALWARE_Win_DLLLoader
Create hunting rule
Author:ditekSHen
Description:Detects unknown DLL Loader
Rule name:win_doppeldridex_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.doppeldridex.
Rule name:win_dridex_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.dridex.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Dridex

DLL dll 87d2c1489a831b10ed176efb8a1bb73657418e4f332d6de0e10fa0f21c71fa11

(this sample)

  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/1850301/
Cape
Cape
https://www.capesandbox.com/analysis/211171/

Comments


Avatar
zbet commented on 2021-12-04 01:36:30 UTC

url : hxxp://fire.hypersys-server.com.ar/1/1.mp3/1182whoreniggagay.bin