🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a3abf81a46e3e318450f496e08d8cd0c9952f43deb4c481e19f9cfd36e884f2a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Dridex


Vendor detections: 9


Intelligence 9 IOCs YARA File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a3abf81a46e3e318450f496e08d8cd0c9952f43deb4c481e19f9cfd36e884f2a
SHA3-384 hash: 57fb032b77c8ea1dbbb405aad083005cf83648435ab7296a1b893f797ee26115532511802f3dfcace1a85da46232f8bc
SHA1 hash: d9fb4101a76039316a5047da32ac29b575ef8167
MD5 hash: 11817679b95e547beb067f8e82f43108
humanhash: purple-london-whiskey-magazine
File name:11817679b95e547beb067f8e82f43108
Download: download sample
Signature Dridex
Create hunting rule
File size:663'552 bytes
First seen:2021-11-17 19:05:02 UTC
Last seen:2021-11-18 05:54:41 UTC
File type:DLL dll
MIME type:application/x-dosexec
imphash fe16443ce39f2fcea9c5accdb27a9eac (21 x Dridex)
ssdeep 12288:WUTlJzJzJBJZn/JH3lJxJLJZJdPgA1VKBUA1rlldOJw:WUJtpDv/lVbdT3IA1wBUA1rlldOK
Threatray 5'345 similar samples on MalwareBazaar
TLSH T1B2E48E0250D512FCFA898ABF155A67C1C6B310824ED1CB9E25CD07EADF64A03EE6D1B7
Reporter zbetcheckin
Tags:32 dll Dridex exe

Intelligence

File Origin
# of uploads :
3
# of downloads :
124
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Detection(s):
SecuriteInfo.com.Drixed-FJX11817679B95E.13947.22849.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Сreating synchronization primitives
DNS request
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/619552634912a8c920a1b897/reports/2f635255-c60a-4452-8de3-ea6635b9c5c9/overview
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/f6c9b842-225e-4f26-ba88-5788499cb261
Result
Threat name:
Dridex
Create hunting rule
Detection:
malicious
Classification:
troj
Score:
72 / 100
Link:
https://www.joesandbox.com/analysis/891470
Signature
C2 URLs / IPs found in malware configuration
Found malware configuration
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Yara detected Dridex unpacked file
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 523943 Sample: ufL7a84E0E Startdate: 17/11/2021 Architecture: WINDOWS Score: 72 17 54.37.70.105 OVHFR France 2->17 19 142.93.218.86 DIGITALOCEAN-ASNUS United States 2->19 21 2 other IPs or domains 2->21 23 Found malware configuration 2->23 25 Multi AV Scanner detection for submitted file 2->25 27 Yara detected Dridex unpacked file 2->27 29 2 other signatures 2->29 9 loaddll32.exe 1 2->9         started        signatures3 process4 process5 11 cmd.exe 1 9->11         started        process6 13 rundll32.exe 11->13         started        process7 15 WerFault.exe 23 9 13->15         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a3abf81a46e3e318450f496e08d8cd0c9952f43deb4c481e19f9cfd36e884f2a/
Threat name:
Win32.Trojan.Drixed
Create hunting rule
Status:
Malicious
First seen:
2021-11-17 19:05:07 UTC
AV detection:
15 of 28 (53.57%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
doppeldridex
Create hunting rule
dridex
Create hunting rule
Similar samples:
2bf87021745923bb669cc6eda22bb54b5249f74f7e7e8a04ebc4f16b01a0a8c4
Dridex
32f0692da6367489eafc71602a1b075e177621e366101241206958a68318cf64
Dridex
33df285d24bac325fa5c56a08462a3ebf34904e4489abe7e6854f3f993ac033f
Dridex
390707cb5b5790b45295bddcb749ffdde7439e1f4e9ef0b732597bf1b75fa534
Dridex
3cba24dba02d5817a029caee6eadf1b3b4eb75ff861c62df3e4d4fbde1c349c2
Dridex
537866a96449444a54002776f34eecf053c23122a554a79f4743df0749aa8005
Dridex
770cb2aa5ea76f90e27bc72110b531fa3985ab4352d25362926971285408f148
Dridex
8536dd733f30a414cb8040e2d15631e1124942b150c75a2ef9178e61d2a75689
Dridex
9e99d5dbe3c26e4b87dc8b60414f9ba1c16c37b2c9672f5f184210c4a3404759
Dridex
+ 5'335 additional samples on MalwareBazaar
Result
Malware family:
dridex
Create hunting rule
Score:
  10/10
Tags:
family:dridex botnet:22203 botnet loader
Link:
https://tria.ge/reports/211117-xrhdjsafem/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Dridex Loader
Dridex
Malware Config
C2 Extraction:
54.37.70.105:443
198.199.70.22:6602
164.68.99.3:5007
142.93.218.86:4664
Unpacked files
SH256 hash:
366ce87e743656480bed6528ed3e94ae78b26736c5ba547a50ed0b478a22c96c
MD5 hash:
623e9d461f59d4b47792019ca1ce52e2
SHA1 hash:
52cb160ca691b50e309969598bbd876636a615b1
Detections:
win_doppeldridex_auto
Create hunting rule
Link:
https://www.unpac.me/results/5a7df845-c744-413a-8dd0-2cd00022a38c/
Parent samples :
a3abf81a46e3e318450f496e08d8cd0c9952f43deb4c481e19f9cfd36e884f2a
87ec152bfeda4a61988a9ade1dd1f45e2f39e7030b584be83de9da95d53a299e
SH256 hash:
2e4da7dbe3d43e07cf011302db7302f7b8d632d6823966ee620ae30cf34662e7
MD5 hash:
fffeb707e430160c6d8914689e04389b
SHA1 hash:
5537b9332c0efbfae10f9b433bb851959bd11cc7
Detections:
win_dridex_auto
Create hunting rule
Link:
https://www.unpac.me/results/5a7df845-c744-413a-8dd0-2cd00022a38c/
Parent samples :
8536dd733f30a414cb8040e2d15631e1124942b150c75a2ef9178e61d2a75689
32f0692da6367489eafc71602a1b075e177621e366101241206958a68318cf64
33df285d24bac325fa5c56a08462a3ebf34904e4489abe7e6854f3f993ac033f
a3abf81a46e3e318450f496e08d8cd0c9952f43deb4c481e19f9cfd36e884f2a
2bf87021745923bb669cc6eda22bb54b5249f74f7e7e8a04ebc4f16b01a0a8c4
85dd0bbdc1dde143ffd3906d04ce15fa415b0f66abfaeb1f3476007c5664438e
832cd5a0d475e0309f03bd6a00ae888e0be1c6a8585f9175e0dbe41d3fc960a6
233abb27be4c337cf8b9999c58b73e5890a61741c896e3afe8794b13d5652eb5
2c74a51c3843ccb411702e116ee7bf7c9efa3d53cbaf3709e789a6305a8ac67f
f81dcc275ffa54a53ed99e79aac49e274b1ce833b5c0c2fcfcb80a33da6e0408
b856b7bf0644dedaadccdc0c6b6c17edffb8d82abfac2db29e6107ecb8ae2912
be3eb491dd9953d6d06879a99357613f2a837f8a79a2ac3b67dfe7e6ce2bfdec
ad0a37a84fe23aa26337b1519c1208f5b2ada3d0ce4e0a6cbcceedf84f1222dc
d45df1bb669ebf3995005dd8e0c4a6999a776501cbca500182024b763b71cc1e
87ec152bfeda4a61988a9ade1dd1f45e2f39e7030b584be83de9da95d53a299e
6f2cb590bad8c42912576399c30686ffe95d28aee7adc9d0507335bb3d7e5824
dd8ac82effcb27eda36f0792d7ff5d50c66bca2c20386c5dd25565970f8234c2
c06e84c106ca78b1189aa03a7269ea76efd7879e3ef28a78ef9dcd5303328411
f1668c85b555e2c76538cbdd30418ccb6b29dc070456eee6bbfb14c55ba2244c
289bbd7c84e632bd35795623e60e1aea165eb25ebd20a6d979b7f01cf43eb0fd
7abfd89f20fc6b4d28c95fd22a977fbc247438071fdb6710fe24487d571c3314
SH256 hash:
a3abf81a46e3e318450f496e08d8cd0c9952f43deb4c481e19f9cfd36e884f2a
MD5 hash:
11817679b95e547beb067f8e82f43108
SHA1 hash:
d9fb4101a76039316a5047da32ac29b575ef8167
Link:
https://www.unpac.me/results/5a7df845-c744-413a-8dd0-2cd00022a38c/
Malware family:
Dridex
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/a3abf81a46e3/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Trojan
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/a3abf81a46e3e318450f496e08d8cd0c9952f43deb4c481e19f9cfd36e884f2a

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Dridex

DLL dll a3abf81a46e3e318450f496e08d8cd0c9952f43deb4c481e19f9cfd36e884f2a

(this sample)

  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/206966/
  
URLhaus
https://urlhaus.abuse.ch/url/1798009/
  
URLhaus
https://urlhaus.abuse.ch/url/1798906/

Comments


Avatar
zbet commented on 2021-11-17 19:05:04 UTC

url : hxxps://49lorg.am.files.1drv.com/y4mJADHIlEWwXpRuhX_AOV58UcKKw0IrJg8q-VBvZFuuteC_q8G7mLxhop7ZXpjfkUbhI_ty_kNvmsM9dwfrGuKOck5HBDGRtS_KtUxzr1-oHnmcZt0UQ8BniPBk6OwsBoyv_iuxuL_lYx08RG2_t_n1ks0nrtTPK9xRBubyYAKgBm99nFsHQQg4azGfmK0Vqe3k6Vlzn-PUpJgjNiGCtESSw/dqrkteouzeq.mp4