🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a4b602ad5624c7570395c8d61fb558727f2e37ce763377d0ddeb93b176b592fb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Dridex


Vendor detections: 10


Intelligence 10 IOCs YARA 6 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a4b602ad5624c7570395c8d61fb558727f2e37ce763377d0ddeb93b176b592fb
SHA3-384 hash: 9f5f1a4229a7af3af0f00f5731e1b156b5e5d299596970c1c052c6ac5fc656daf88887be4520fc9274735861584faf4f
SHA1 hash: 6f40daf3effebd4a63d90f1fe7a21bf7a3b5be43
MD5 hash: c153fbaae1a7947942c074e1d8c59b34
humanhash: hotel-arizona-florida-sad
File name:SecuriteInfo.com.W32.Dridex.GB.genEldorado.6285.28277
Download: download sample
Signature Dridex
Create hunting rule
File size:520'192 bytes
First seen:2021-12-20 23:18:40 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash 2b1b4edc6ebe7eca63696f6220126258 (7 x Dridex)
ssdeep 6144:M5a3RjZ1XrZvR7Z9JrZdR5ZbR1Z9RVZ1RvZpR17fRrZpRrTZRfZ3Rr3fRJZfRlZn:RbTFRJXfZrFTfVBokoa7fGs8E7l
Threatray 5'730 similar samples on MalwareBazaar
TLSH T12BB48E29E83826A4FC351F3875E0B3CEB653D9145B3B81707B7D9B348782991ECA61C6
Reporter SecuriteInfoCom
Tags:dll Dridex

Intelligence

File Origin
# of uploads :
1
# of downloads :
653
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.W32.Dridex.GB.genEldorado.6285.28277.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Sending a custom TCP request
DNS request
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/61c10f874ab5c44cbf4ac96c/reports/233cc7c2-0316-4420-b762-ea8f72f87c13/overview
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/9567b374-ee0b-4048-bc64-3eb9be2b0de0
Result
Threat name:
Dridex
Create hunting rule
Detection:
malicious
Classification:
troj
Score:
76 / 100
Link:
https://www.joesandbox.com/analysis/910661
Signature
C2 URLs / IPs found in malware configuration
Found malware configuration
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Sigma detected: Suspicious Call by Ordinal
Yara detected Dridex unpacked file
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 543138 Sample: SecuriteInfo.com.W32.Dridex... Startdate: 21/12/2021 Architecture: WINDOWS Score: 76 17 93.104.209.107 MNET-ASGermanyDE Germany 2->17 19 144.91.122.100 CONTABODE Germany 2->19 21 2 other IPs or domains 2->21 23 Found malware configuration 2->23 25 Multi AV Scanner detection for submitted file 2->25 27 Yara detected Dridex unpacked file 2->27 29 3 other signatures 2->29 9 loaddll32.exe 1 2->9         started        signatures3 process4 process5 11 cmd.exe 1 9->11         started        process6 13 rundll32.exe 11->13         started        process7 15 WerFault.exe 23 9 13->15         started       
Detection:
dridex
Create hunting rule
Link:
https://mwdb.cert.pl/sample/a4b602ad5624c7570395c8d61fb558727f2e37ce763377d0ddeb93b176b592fb/
Threat name:
Win32.Infostealer.Dridex
Create hunting rule
Status:
Malicious
First seen:
2021-12-20 20:43:25 UTC
File Type:
PE (Dll)
AV detection:
17 of 28 (60.71%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=us3aflkwetdvoa4vzdlb7nkyoj7s4n6ooyzxpug55oj3c5vvsl5q._file
Verdict:
malicious
Label(s):
doppeldridex
Create hunting rule
dridex
Create hunting rule
Similar samples:
42a44e52c0b4d3105ce3f46b7ce7bd30eb24c9b320823e1c25d7ca37f1cf32f8
Dridex
594bb2ed8db58f342ea2a9a6cd9f87b102b78538e2e45757a6fa0c83b37b4b38
Dridex
9a92587563a7be70787c52f46a5bbd5240cf012ba5ec77e23d04bda3d652a9c7
Dridex
c4ee2acc6b5aca21235917972c19d30c5585662b59decc6994c54d51bf5d5b80
Dridex
ce02033f92d2acef752f129963acc1e34a00521ad120258685cc52f98b3a603e
Dridex
+ 5'720 additional samples on MalwareBazaar
Result
Malware family:
dridex
Create hunting rule
Score:
  10/10
Tags:
family:dridex botnet:22201 botnet loader
Link:
https://tria.ge/reports/211220-3avkfacac7/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Dridex Loader
Dridex
Malware Config
C2 Extraction:
144.91.122.100:443
188.214.241.242:4664
93.104.209.107:8116
5.189.190.214:593
Unpacked files
SH256 hash:
0641b41a9c59481e5197c11a0c025211b344d0487da45cd8a3231f031f484e7b
MD5 hash:
d96fa490d75632b62df30bd4c19ca826
SHA1 hash:
4206f1965d62f6cf851f4ba0d26cf56fd81b79a0
Detections:
win_doppeldridex_auto
Create hunting rule
Link:
https://www.unpac.me/results/bad1ed74-408b-4487-a002-4b0bc22118f8/
SH256 hash:
4d620a0cd0b47ed20c05c3b96c938d050941f2e2627a9bf088ac8634af7ea4b6
MD5 hash:
ad50cb79d9abe9bf03b81cc1e54b10bf
SHA1 hash:
8b731c9ad3c37461338a4140a1700f4e36baf05f
Detections:
win_dridex_auto
Create hunting rule
Link:
https://www.unpac.me/results/bad1ed74-408b-4487-a002-4b0bc22118f8/
Parent samples :
594bb2ed8db58f342ea2a9a6cd9f87b102b78538e2e45757a6fa0c83b37b4b38
9a92587563a7be70787c52f46a5bbd5240cf012ba5ec77e23d04bda3d652a9c7
145b6b65c2627e10b663d7f1609ff56380262d9dc8850b7ac31cb3ee4feb511d
94a784a5377541aa2f994182ff9308cc1265938088aa87a2a1d3198f29509793
a4b602ad5624c7570395c8d61fb558727f2e37ce763377d0ddeb93b176b592fb
673ff75f1fc774b6bf83689e9394b17587c795611b3ef2dae9c865bf6949d344
2b25238c00aa0596c7132d869b2a208803a51c22b76e9b22562f930be4d1a17b
SH256 hash:
a4b602ad5624c7570395c8d61fb558727f2e37ce763377d0ddeb93b176b592fb
MD5 hash:
c153fbaae1a7947942c074e1d8c59b34
SHA1 hash:
6f40daf3effebd4a63d90f1fe7a21bf7a3b5be43
Link:
https://www.unpac.me/results/bad1ed74-408b-4487-a002-4b0bc22118f8/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.96
Link:
https://yomi.yoroi.company/submissions/a4b602ad5624c7570395c8d61fb558727f2e37ce763377d0ddeb93b176b592fb

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DridexLoader
Create hunting rule
Author:kevoreilly
Description:Dridex v4 dropper C2 parsing function
Rule name:DridexV4
Create hunting rule
Author:kevoreilly
Description:Dridex v4 Payload
Rule name:dridex_loader
Create hunting rule
Author:kevoreilly
Description:Dridex Loader
Rule name:MALWARE_Win_DLLLoader
Create hunting rule
Author:ditekSHen
Description:Detects unknown DLL Loader
Rule name:win_doppeldridex_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.doppeldridex.
Rule name:win_dridex_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.dridex.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Dridex

DLL dll a4b602ad5624c7570395c8d61fb558727f2e37ce763377d0ddeb93b176b592fb

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1903945/
  
Delivery method
Distributed via web download

Comments