🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9da7c4d51a2d18aa3e79bfe0c2fa6fb1a6e1754c73985bce90c4c5c1a90e41d3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Dridex


Vendor detections: 10


Intelligence 10 IOCs YARA 6 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9da7c4d51a2d18aa3e79bfe0c2fa6fb1a6e1754c73985bce90c4c5c1a90e41d3
SHA3-384 hash: 6233d48a29ad6561e62cf5dc5978a69812b774b9f0ae8815b040eb1eb2fff9d53606e2ab883e774ac65b326cc5dcadc1
SHA1 hash: ae083db0d774ef1ade850a55cc84fa802a45f392
MD5 hash: 4bc0acf6caef9d62f0a347d230ae22bb
humanhash: pennsylvania-zebra-ack-ink
File name:SecuriteInfo.com.W32.AIDetect.malware1.25720.15959
Download: download sample
Signature Dridex
Create hunting rule
File size:479'232 bytes
First seen:2021-12-20 23:18:34 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash d67883ee85eede67419711a8fbd7ca0d (43 x Dridex)
ssdeep 6144:Hx0610FnNqVnt0Rt1CVlp0R5aMSw8EekUXnAwd37izAQqK/o2B6LjiReYiLzEU:HS6MSw8EekuB37izvjI/kU
Threatray 5'730 similar samples on MalwareBazaar
TLSH T157A4AF3181C5528AD705123423DA8065227F5326CC957FBF9CF982732A6BAEDDE3E0D6
Reporter SecuriteInfoCom
Tags:dll Dridex

Intelligence

File Origin
# of uploads :
1
# of downloads :
563
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.W32.AIDetect.malware1.25720.15959.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
DNS request
Sending a custom TCP request
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/61c10f82ec6c6c14a9e61cc7/reports/26e649b0-8170-4150-ac94-e29e89bbcfe9/overview
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/4a84c304-57d5-4cb9-a385-ce999253ae66
Result
Threat name:
Dridex
Create hunting rule
Detection:
malicious
Classification:
troj
Score:
72 / 100
Link:
https://www.joesandbox.com/analysis/910665
Signature
C2 URLs / IPs found in malware configuration
Found malware configuration
Multi AV Scanner detection for submitted file
Sigma detected: Suspicious Call by Ordinal
Yara detected Dridex unpacked file
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 543141 Sample: SecuriteInfo.com.W32.AIDete... Startdate: 21/12/2021 Architecture: WINDOWS Score: 72 18 120.50.40.185 M1NET-SG-APM1NETLTDSG Singapore 2->18 20 139.162.113.169 LINODE-APLinodeLLCUS Netherlands 2->20 22 2 other IPs or domains 2->22 26 Found malware configuration 2->26 28 Multi AV Scanner detection for submitted file 2->28 30 Yara detected Dridex unpacked file 2->30 32 2 other signatures 2->32 9 loaddll32.exe 1 2->9         started        signatures3 process4 process5 11 cmd.exe 1 9->11         started        process6 13 rundll32.exe 11->13         started        process7 15 WerFault.exe 23 9 13->15         started        dnsIp8 24 192.168.2.1 unknown unknown 15->24
Detection:
dridex
Create hunting rule
Link:
https://mwdb.cert.pl/sample/9da7c4d51a2d18aa3e79bfe0c2fa6fb1a6e1754c73985bce90c4c5c1a90e41d3/
Threat name:
Win32.Infostealer.Dridex
Create hunting rule
Status:
Malicious
First seen:
2021-12-20 19:26:37 UTC
File Type:
PE (Dll)
AV detection:
22 of 28 (78.57%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=twt4jvi2fumkuptzx7qmf6tpwgtoc5kmoomfxtuqytc4dkioihjq._file
Verdict:
malicious
Label(s):
doppeldridex
Create hunting rule
dridex
Create hunting rule
Similar samples:
1aa52252a9ae1c24c9a587d84bbe8ad42ea834ecb2f5e363660d0180a0fd358b
Dridex
2af7a19afa51d819cfe4bcead0aa63c4dbb9c1194363896500b0ef626908ca13
Dridex
4e41e0a0750125693aeadde94e11f23f9b29a81b26b41463117bd39d19374f84
Dridex
7319faf4a324a7aec6b898b06f822b59f24a2c702929a146908829c5ddccfe83
Dridex
a8897a78cf5acc27d3f7a4b9d71f23f21e669b47628ef2964a2a455f2ead22b1
Dridex
b3f2455dbdfadfdb76026bff37d4180f90b8dcfed7ce84043e2fcef4ae33b5e1
Dridex
e1dbc17cfcab4b6b14a07dde15327991d38a314c26a8464bebefb1118f16511a
Dridex
e5607a5a103d6bc04f97ffdeea63ba4629a6f99d55d89d2b2047e6d61c539357
Dridex
ee14add8eb5342d6c672dbff573b0737ac4f718f06d2881f9d319e6c806db770
Dridex
+ 5'720 additional samples on MalwareBazaar
Result
Malware family:
dridex
Create hunting rule
Score:
  10/10
Tags:
family:dridex botnet:22206 botnet loader
Link:
https://tria.ge/reports/211220-3at9nscac4/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Dridex Loader
Dridex
Malware Config
C2 Extraction:
120.50.40.185:443
139.59.14.223:8172
121.40.104.209:6602
139.162.113.169:593
Unpacked files
SH256 hash:
ffb7aa3836956922646b7f5994cf9a01d7f3056d7bc1ab564c86d69e8192bd6d
MD5 hash:
f01d3d5e14b705cdbd8e84b896079c7d
SHA1 hash:
3f3b7e654aeb1bb66865cbc0f8f3ca1dad2f3a7f
Detections:
win_doppeldridex_auto
Create hunting rule
Link:
https://www.unpac.me/results/6140627e-51d8-451b-a5b3-e57d82275a57/
Parent samples :
c237ec97aa1aa067b567fa4bf87c6d102ccd35b51a23ea5100ed3559bed9ee07
9da7c4d51a2d18aa3e79bfe0c2fa6fb1a6e1754c73985bce90c4c5c1a90e41d3
SH256 hash:
45feffe2ffb4ccc9be7a9f83dff63872fd2cf0f2e73294437e129049c311e6e7
MD5 hash:
aa101a4ee8059becbb1578b06d55d1e6
SHA1 hash:
d6a347f70407b7afcc5575cb211b24e46ab614a5
Detections:
win_dridex_auto
Create hunting rule
Link:
https://www.unpac.me/results/6140627e-51d8-451b-a5b3-e57d82275a57/
Parent samples :
cfdd42a62ed1a612d0a08b55668512b1bb8e48e4540ec123f2bfc72ca0df0728
49b240bca4cd10a3fa1537f926fdaca286a42dadf8b1b97c4f7da5fb19f0edc2
21b2d88c08031360ac8030f7a8a147f203a44d1ace183dd17975eda2a093c4ff
f5bae6a4fc581989e33d29352755daff2de067a3bdefd91d6b18a452466269d3
208b0e4bc7dafb4ba814c3f7bf734c4e7fa4e930d80bd56870981392a94ce380
ab3bf17d94030cb3a6df9c01c2f2473dfe7c3a3e2d73e5c2f28c13569bdb6e3f
78e1c5e1e6bb037e2dede98a0248aa43317b5d101639d54073882fe980768e8c
f0680e26115bcd02184db5dea1c8b6134608ac211e6ea37d0ec12137eda29941
73aee1f4ca4cb7ff2b9ec1425a875d2a556e7fcc05a8d406019ea3177ae8b2d3
1b58475744840f7ace6661cbcaacd05e0c4dfaa1958ad9d057b35a79497b01e4
13ea7c503533713d9dd7351bdab7d52ee2e5347d27c2cf8f74c889c4c5430185
3dc02a6cf72c63b8a2308cd39d45eebc64580c74bd14027bcfb306752db0596d
f33baf46bb93789e96536d92df5fe70f8ede45c9cecd6e4ef7f24b0c3f032053
7f2c7437aff6d900e5bdf9f51880113b6c6f8677c1be8a9fbb1f23eadb7d602c
4d3fd93b2369a670084abd4e9623896a6b836ebd5e843bc00a00c3179eb68976
d970cedd941e247e1b7aa55c150feb091ae7ef67b2b7ec353b87c657a16697c9
61e1955b6f145e66d59fa0d927165135c9b49738c7557212d09687c5d6666e84
4533b582eb2b0c0664312bb69409f6cbd3f4400005c3d5722ca9e02f7eb68e6d
44f4ef22f6a6edb59396c97a9a553c1e76850f3cbeb38a9746ed4df5741cb770
bfddf1832640408e64d941058b3030aafd9f945bb5c821641ca833fba4401590
c237ec97aa1aa067b567fa4bf87c6d102ccd35b51a23ea5100ed3559bed9ee07
36d55638947ea8b31a80bca274a6ec720b665dfd4cbb511e19b241c9666da0ca
dd5173abdb268c5833e6d1945dc61f87fd9aa807e3b610f547b47fc802f9f2b1
377576fdb5ae91a0f4f0835c81babb80b68910ba17ef224ae4fa108d9153c7d4
b8e72a9dfabd57a4b11dbdba14b8e96ca9b081091d5268d08a6c0e999e38a95a
9da7c4d51a2d18aa3e79bfe0c2fa6fb1a6e1754c73985bce90c4c5c1a90e41d3
58810e4b465473493c929a18f2eb596aa0d721ad62d23a157f2c0a6916fd0aa2
685cfa389b847b15c5b4d0af55eb9e4e9944db38c630789c307e808118eda8aa
cb9173ee1d6bd874578ec9fb4cfc61fee233dd1721d4ae8b38d71c5c23e7ff78
649b719b3ee467ea1a1c824cfc5db7a1eae33b05b9182ee4190541d32bf96b8d
599cdcdb3891f9d46b8b320943f8112a8eec63b732272d82ce8e95a1fbc3c6e6
7cc0d16fe4e01e60f5eed66d1d6e58a9143129e8326cb16f8126664ce821f2d1
1cb0d92d0a1bd0226fe5c1aa7d841d188924c4dc5b57d3397111733d24f1d0e4
bdf841f003aa7aa8a2a842918b18c9797508af4e8bb72ebe8343073df16172a7
c7a28cc9d0d632be29b01873282dd07879a961b63ef923cee43ff16b752b38d2
bc38064e8938cff283b33b23ae76faa2dc1a08d5866981c7324183b5922d7434
c5b52cd1ada1c319e8e3dab79eb0373853b052075685a793fd3471179a3af564
4d62e3327b3a0440069f61c89524c4af3af7a9aec9c0664465c6c1f4650fe77b
529a5bd3d20b261adf861d16181308f6ba1c78954a06ac81c03a14ca91b927dd
87e2dad373f75f5c0a200821523aebe45f6f4103b51fb0155ed2bf060ec50b04
88902dbfead91e58e427308d0a4ab5c936b1c54d31d926ae99cd1642cd6a4bbc
8179bc64652d44d11b75f64430faa3bf9ebb6a4086af14ee4018b8bf36e685a3
c5b456ade77af6125a2c002c0c41f7d757e970250e4a9e472b1fa8489f26869b
SH256 hash:
9da7c4d51a2d18aa3e79bfe0c2fa6fb1a6e1754c73985bce90c4c5c1a90e41d3
MD5 hash:
4bc0acf6caef9d62f0a347d230ae22bb
SHA1 hash:
ae083db0d774ef1ade850a55cc84fa802a45f392
Link:
https://www.unpac.me/results/6140627e-51d8-451b-a5b3-e57d82275a57/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.96
Link:
https://yomi.yoroi.company/submissions/9da7c4d51a2d18aa3e79bfe0c2fa6fb1a6e1754c73985bce90c4c5c1a90e41d3

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DridexLoader
Create hunting rule
Author:kevoreilly
Description:Dridex v4 dropper C2 parsing function
Rule name:DridexV4
Create hunting rule
Author:kevoreilly
Description:Dridex v4 Payload
Rule name:dridex_loader
Create hunting rule
Author:kevoreilly
Description:Dridex Loader
Rule name:MALWARE_Win_DLLLoader
Create hunting rule
Author:ditekSHen
Description:Detects unknown DLL Loader
Rule name:win_doppeldridex_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.doppeldridex.
Rule name:win_dridex_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.dridex.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Dridex

DLL dll 9da7c4d51a2d18aa3e79bfe0c2fa6fb1a6e1754c73985bce90c4c5c1a90e41d3

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1903898/
  
Delivery method
Distributed via web download

Comments