🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 87ec152bfeda4a61988a9ade1dd1f45e2f39e7030b584be83de9da95d53a299e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Dridex


Vendor detections: 11


Intelligence 11 IOCs YARA 6 File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 87ec152bfeda4a61988a9ade1dd1f45e2f39e7030b584be83de9da95d53a299e
SHA3-384 hash: 85197c4cffd7fab31e5b0e9944a2a1a2a65811afd18bc4d0f6c6c9ea72f6eec37339a9837a119b9ff46f12c1cac8c821
SHA1 hash: a4101d34d5dbf7d7248750937905202ec6723037
MD5 hash: 4e56e551c6c189a52d3e890f84394842
humanhash: harry-december-alanine-seventeen
File name:4e56e551c6c189a52d3e890f84394842
Download: download sample
Signature Dridex
Create hunting rule
File size:663'552 bytes
First seen:2021-11-18 15:20:57 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash fe16443ce39f2fcea9c5accdb27a9eac (21 x Dridex)
ssdeep 12288:8KTlJzJzJBJZn/JH3lJxJLJZJdPgA1VKBUA1rlldgJw:8KJtpDv/lVbdT3IA1wBUA1rlldgK
Threatray 5'371 similar samples on MalwareBazaar
TLSH T164E48E0250D512FCFA898ABF155A67C1C6B310824ED1CB9E25CD07EADF64A03EE6D1B7
Reporter zbetcheckin
Tags:32 dll Dridex exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
152
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Result
Verdict:
Clean
Maliciousness:

Behaviour
Searching for the window
Сreating synchronization primitives
DNS request
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/61966f614912a8c920a2b215/reports/9be0ab58-045a-45c4-a402-7b23fceda057/overview
Malware family:
Dridex
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/3206ca35-1e0e-4978-9c66-a46ad22aa2a1
Result
Threat name:
Dridex
Create hunting rule
Detection:
malicious
Classification:
troj
Score:
72 / 100
Link:
https://www.joesandbox.com/analysis/892051
Signature
C2 URLs / IPs found in malware configuration
Found malware configuration
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Yara detected Dridex unpacked file
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 524524 Sample: opuVMeJaCS Startdate: 18/11/2021 Architecture: WINDOWS Score: 72 17 54.37.70.105 OVHFR France 2->17 19 142.93.218.86 DIGITALOCEAN-ASNUS United States 2->19 21 2 other IPs or domains 2->21 23 Found malware configuration 2->23 25 Multi AV Scanner detection for submitted file 2->25 27 Yara detected Dridex unpacked file 2->27 29 2 other signatures 2->29 9 loaddll32.exe 1 2->9         started        signatures3 process4 process5 11 cmd.exe 1 9->11         started        process6 13 rundll32.exe 11->13         started        process7 15 WerFault.exe 23 9 13->15         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/87ec152bfeda4a61988a9ade1dd1f45e2f39e7030b584be83de9da95d53a299e/
Threat name:
Win32.Trojan.GenericML
Create hunting rule
Status:
Malicious
First seen:
2021-11-18 14:25:43 UTC
AV detection:
17 of 27 (62.96%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=q7wbkk763jfgdgektlpb3upulyxttzydbnmex2b55hnjlvj2fgpa._file
Verdict:
malicious
Label(s):
doppeldridex
Create hunting rule
dridex
Create hunting rule
Similar samples:
233abb27be4c337cf8b9999c58b73e5890a61741c896e3afe8794b13d5652eb5
Dridex
2bf87021745923bb669cc6eda22bb54b5249f74f7e7e8a04ebc4f16b01a0a8c4
Dridex
2c74a51c3843ccb411702e116ee7bf7c9efa3d53cbaf3709e789a6305a8ac67f
Dridex
32f0692da6367489eafc71602a1b075e177621e366101241206958a68318cf64
Dridex
33df285d24bac325fa5c56a08462a3ebf34904e4489abe7e6854f3f993ac033f
Dridex
832cd5a0d475e0309f03bd6a00ae888e0be1c6a8585f9175e0dbe41d3fc960a6
Dridex
8536dd733f30a414cb8040e2d15631e1124942b150c75a2ef9178e61d2a75689
Dridex
85dd0bbdc1dde143ffd3906d04ce15fa415b0f66abfaeb1f3476007c5664438e
Dridex
a3abf81a46e3e318450f496e08d8cd0c9952f43deb4c481e19f9cfd36e884f2a
Dridex
f81dcc275ffa54a53ed99e79aac49e274b1ce833b5c0c2fcfcb80a33da6e0408
Dridex
+ 5'361 additional samples on MalwareBazaar
Result
Malware family:
dridex
Create hunting rule
Score:
  10/10
Tags:
family:dridex botnet:22203 botnet loader
Link:
https://tria.ge/reports/211118-srbtjshde9/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Dridex Loader
Dridex
Malware Config
C2 Extraction:
54.37.70.105:443
198.199.70.22:6602
164.68.99.3:5007
142.93.218.86:4664
Unpacked files
SH256 hash:
366ce87e743656480bed6528ed3e94ae78b26736c5ba547a50ed0b478a22c96c
MD5 hash:
623e9d461f59d4b47792019ca1ce52e2
SHA1 hash:
52cb160ca691b50e309969598bbd876636a615b1
Detections:
win_doppeldridex_auto
Create hunting rule
Link:
https://www.unpac.me/results/c2414e99-b82a-4c10-b177-13f02fc29deb/
Parent samples :
a3abf81a46e3e318450f496e08d8cd0c9952f43deb4c481e19f9cfd36e884f2a
87ec152bfeda4a61988a9ade1dd1f45e2f39e7030b584be83de9da95d53a299e
SH256 hash:
2e4da7dbe3d43e07cf011302db7302f7b8d632d6823966ee620ae30cf34662e7
MD5 hash:
fffeb707e430160c6d8914689e04389b
SHA1 hash:
5537b9332c0efbfae10f9b433bb851959bd11cc7
Detections:
win_dridex_auto
Create hunting rule
Link:
https://www.unpac.me/results/c2414e99-b82a-4c10-b177-13f02fc29deb/
Parent samples :
8536dd733f30a414cb8040e2d15631e1124942b150c75a2ef9178e61d2a75689
32f0692da6367489eafc71602a1b075e177621e366101241206958a68318cf64
33df285d24bac325fa5c56a08462a3ebf34904e4489abe7e6854f3f993ac033f
a3abf81a46e3e318450f496e08d8cd0c9952f43deb4c481e19f9cfd36e884f2a
2bf87021745923bb669cc6eda22bb54b5249f74f7e7e8a04ebc4f16b01a0a8c4
85dd0bbdc1dde143ffd3906d04ce15fa415b0f66abfaeb1f3476007c5664438e
832cd5a0d475e0309f03bd6a00ae888e0be1c6a8585f9175e0dbe41d3fc960a6
233abb27be4c337cf8b9999c58b73e5890a61741c896e3afe8794b13d5652eb5
2c74a51c3843ccb411702e116ee7bf7c9efa3d53cbaf3709e789a6305a8ac67f
f81dcc275ffa54a53ed99e79aac49e274b1ce833b5c0c2fcfcb80a33da6e0408
b856b7bf0644dedaadccdc0c6b6c17edffb8d82abfac2db29e6107ecb8ae2912
be3eb491dd9953d6d06879a99357613f2a837f8a79a2ac3b67dfe7e6ce2bfdec
ad0a37a84fe23aa26337b1519c1208f5b2ada3d0ce4e0a6cbcceedf84f1222dc
d45df1bb669ebf3995005dd8e0c4a6999a776501cbca500182024b763b71cc1e
87ec152bfeda4a61988a9ade1dd1f45e2f39e7030b584be83de9da95d53a299e
6f2cb590bad8c42912576399c30686ffe95d28aee7adc9d0507335bb3d7e5824
dd8ac82effcb27eda36f0792d7ff5d50c66bca2c20386c5dd25565970f8234c2
c06e84c106ca78b1189aa03a7269ea76efd7879e3ef28a78ef9dcd5303328411
f1668c85b555e2c76538cbdd30418ccb6b29dc070456eee6bbfb14c55ba2244c
289bbd7c84e632bd35795623e60e1aea165eb25ebd20a6d979b7f01cf43eb0fd
7abfd89f20fc6b4d28c95fd22a977fbc247438071fdb6710fe24487d571c3314
SH256 hash:
87ec152bfeda4a61988a9ade1dd1f45e2f39e7030b584be83de9da95d53a299e
MD5 hash:
4e56e551c6c189a52d3e890f84394842
SHA1 hash:
a4101d34d5dbf7d7248750937905202ec6723037
Link:
https://www.unpac.me/results/c2414e99-b82a-4c10-b177-13f02fc29deb/
Malware family:
Dridex
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/87ec152bfeda/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Dridex
Score:
0.90
Link:
https://yomi.yoroi.company/submissions/87ec152bfeda4a61988a9ade1dd1f45e2f39e7030b584be83de9da95d53a299e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DridexLoader
Create hunting rule
Author:kevoreilly
Description:Dridex v4 dropper C2 parsing function
Rule name:DridexV4
Create hunting rule
Author:kevoreilly
Description:Dridex v4 Payload
Rule name:dridex_loader
Create hunting rule
Author:kevoreilly
Description:Dridex Loader
Rule name:MALWARE_Win_DLLLoader
Create hunting rule
Author:ditekSHen
Description:Detects unknown DLL Loader
Rule name:win_doppeldridex_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.doppeldridex.
Rule name:win_dridex_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.dridex.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Dridex

DLL dll 87ec152bfeda4a61988a9ade1dd1f45e2f39e7030b584be83de9da95d53a299e

(this sample)

  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/1799542/
Cape
Cape
https://www.capesandbox.com/analysis/207289/

Comments


Avatar
zbet commented on 2021-11-18 15:20:58 UTC

url : hxxps://v8icew.db.files.1drv.com/y4mY2vdoI-cXJgHVAXWJLyi17Hm13s-aXV0n4yLXPgA9PqUhFFW7Z8t84ydu3KRqyzZqFfZS9daN-n-TY3MLWjB-KRE2vbfer07D9ugt2fDcYIec_Zl-XVVlHLalk7piMNut57mDwNse08Itnj8OkdjljIIwRV9e1W2veZTzPlyX3B63oX12K60x3iDhQwy2yJHrkQOI81NjVr-UcaFhEPwuQ/ybtceacazbo.mp4