🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 929393857e856711b2e77876162c826d99f717f7e2d3fc64a5c6e56549585fff. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Dridex


Vendor detections: 11


Intelligence 11 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 929393857e856711b2e77876162c826d99f717f7e2d3fc64a5c6e56549585fff
SHA3-384 hash: d60968f4402eafdcdfbeeba2ff31cb1c011c009e0ff850e55a424d043d8273cfa08f58e5dc69bac087bf8e1832c2093d
SHA1 hash: 87bc5945e97e5e511bf789e98c56db003ef806de
MD5 hash: 53183e60ca148944faddcbda7efa2cde
humanhash: nevada-missouri-coffee-gee
File name:SecuriteInfo.com.Trojan.Win32.Sabsik.FL.Bml.10600.6016
Download: download sample
Signature Dridex
Create hunting rule
File size:768'000 bytes
First seen:2021-10-27 17:15:27 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash f6d4b47e1bc89bb641c0d813d6729161 (47 x Dridex)
ssdeep 12288:lhB6OmN5lx6S3P8UUY9eHTYtI6jd/Tvyis6SX3hwxwXcKjNE3Z7w31TwMGj0/fc:l0LUY9eziI6NT6JtXxwGNCZ831TCQ/f
Threatray 988 similar samples on MalwareBazaar
TLSH T1F0F4CF1336EAC079D072157841A0B5E05DCDBE61642E9EEBA390323E863ACD2797D71F
Reporter SecuriteInfoCom
Tags:dll Dridex

Intelligence

File Origin
# of uploads :
1
# of downloads :
137
Origin country :
n/a
Vendor Threat Intelligence
Detection:
DridexLoader
Create hunting rule
Link:
https://www.capesandbox.com/analysis/200686/
Detection(s):
SecuriteInfo.com.Trojan.Win32.Sabsik.FL.Bml.10600.6016.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
greyware
Link:
https://www.filescan.io/uploads/617989589a5a1e91c5d7af4a/reports/f26a4b1c-9215-45f8-b0f1-033b02850994/overview
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/9e60f095-4110-4037-bd2f-0692d87c68e7
Result
Threat name:
Dridex
Create hunting rule
Detection:
malicious
Classification:
bank.troj.evad
Score:
96 / 100
Link:
https://www.joesandbox.com/analysis/878002
Signature
C2 URLs / IPs found in malware configuration
Detected Dridex e-Banking trojan
Found malware configuration
Machine Learning detection for sample
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
System process connects to network (likely due to code injection or exploit)
Yara detected Dridex unpacked file
Behaviour
Behavior Graph:
Download SVG
Detection:
dridex
Create hunting rule
Link:
https://mwdb.cert.pl/sample/929393857e856711b2e77876162c826d99f717f7e2d3fc64a5c6e56549585fff/
Threat name:
Win32.Infostealer.Dridex
Create hunting rule
Status:
Malicious
First seen:
2021-10-27 15:49:43 UTC
AV detection:
10 of 27 (37.04%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=skjzhbl6qvtrdmxhpb3bmlecnwm7of7x4lj7yzffy3swkskyl77q._file
Verdict:
malicious
Label(s):
dridex
Create hunting rule
gozi
Create hunting rule
Similar samples:
00980f874952ec18d463f4e574e7e4c4c2ed948b4a295285dc740a8ee2ccafd1
Dridex
0e1a864b3d7d4dafb191dc6614c4b3f43fab1d9970d37e5900cbc1d1a11524df
Dridex
2ec8b3b5d5d94269fd4db4f1569f6d853f9e1c4543450b40acda09e0a273d666
Dridex
4ef0bd084a312b416f819ea598abb6959f2163f2da9537bdee4d430b2a3ba370
Dridex
a08a30310095aee3818cb1aed38a87f36c6b2c0466ac483baf6f5319b54ed75b
Dridex
a728c51b40b9aa217a0e6b7d27d389325bbe2ff7a275c2a764a2a651d2c7c940
Dridex
a9734decc445148d3c25da89de8452032fd6cd65530e5733c02576d14abb746d
Dridex
c721d124999fe9388e49688994b3316a0b7c4735f96012a5efa20e1aabf87188
Dridex
e07ae56f0cb20f2bc6a9a5dab953bd97e4a4c2047d784dab106d3fd3eb535b3c
Dridex
+ 978 additional samples on MalwareBazaar
Result
Malware family:
dridex
Create hunting rule
Score:
  10/10
Tags:
family:dridex botnet:10555 botnet discovery evasion trojan
Link:
https://tria.ge/reports/211027-vs55wsfgg9/
Behaviour
Suspicious use of WriteProcessMemory
Checks installed software on the system
Checks whether UAC is enabled
Blocklisted process makes network request
Dridex
Malware Config
C2 Extraction:
192.46.210.220:443
143.244.140.214:808
45.77.0.96:6891
185.56.219.47:8116
Unpacked files
SH256 hash:
8c18d25bd3286e087230db33132382451eb453e1670b6231e118fccd7e1d548c
MD5 hash:
e5413f99beeafeef35ad924351bbece7
SHA1 hash:
7e2c5040fecb77b2a6086cbde816b265e6e71a3d
Link:
https://www.unpac.me/results/1623560e-e2c7-4349-a09a-1e1e65aea91f/
SH256 hash:
929393857e856711b2e77876162c826d99f717f7e2d3fc64a5c6e56549585fff
MD5 hash:
53183e60ca148944faddcbda7efa2cde
SHA1 hash:
87bc5945e97e5e511bf789e98c56db003ef806de
Link:
https://www.unpac.me/results/1623560e-e2c7-4349-a09a-1e1e65aea91f/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/929393857e856711b2e77876162c826d99f717f7e2d3fc64a5c6e56549585fff

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DridexLoader
Create hunting rule
Author:kevoreilly
Description:Dridex v4 dropper C2 parsing function
Rule name:win_dridex_loader_v2
Create hunting rule
Author:Johannes Bader @viql
Description:detects some Dridex loaders

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Dridex

DLL dll 929393857e856711b2e77876162c826d99f717f7e2d3fc64a5c6e56549585fff

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1718748/
  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/1719766/
Cape
Cape
https://www.capesandbox.com/analysis/200686/

Comments