🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a76bc3d7145311be213e3d4ef16a7840208dbf6d354b543c52822dc2ecaa7a6c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Dridex


Vendor detections: 10


Intelligence 10 IOCs YARA 6 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a76bc3d7145311be213e3d4ef16a7840208dbf6d354b543c52822dc2ecaa7a6c
SHA3-384 hash: ec64fd23efaaec8fafb18778a436df238fec15cfec7d8edd7a5dae8dce55bbb6c8557fdf6e55fa1af56098802aab3200
SHA1 hash: d3ac86c1cc2fb6a3138acb015c58e4b21cdad373
MD5 hash: 07ceda8350df47b2ef9443985426a9eb
humanhash: december-south-jersey-kansas
File name:SecuriteInfo.com.W32.AIDetect.malware1.29878.2911
Download: download sample
Signature Dridex
Create hunting rule
File size:786'432 bytes
First seen:2021-11-30 00:40:59 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash caa5f78b710a1e69e3b6a0df7c9b8051 (3 x Dridex)
ssdeep 12288:KsBI3CnCjqHi747SL47gZEvkdqtA1Gb05yfin8hqfoXq3kNYjaJghss6rC+ZgUDo:KsmyC2Ccu0U2skOcgY68Yga0KOCa4MJY
Threatray 5'480 similar samples on MalwareBazaar
TLSH T13DF49E6B97EA0605E1C38A3ACF15D29368B38C459C075AD7A908EF9D443D72F4CFD24A
Reporter SecuriteInfoCom
Tags:dll Dridex

Intelligence

File Origin
# of uploads :
1
# of downloads :
167
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.W32.AIDetect.malware1.29878.2911.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/61a57322c4c53141482288f6/reports/00555f07-ad44-4788-a9b3-105ceb2e945a/overview
Malware family:
Dridex
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/549e62db-d164-4323-a125-97db37434adc
Result
Threat name:
Dridex
Create hunting rule
Detection:
malicious
Classification:
troj
Score:
68 / 100
Link:
https://www.joesandbox.com/analysis/898359
Signature
C2 URLs / IPs found in malware configuration
Found malware configuration
Multi AV Scanner detection for submitted file
Yara detected Dridex unpacked file
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 530837 Sample: SecuriteInfo.com.W32.AIDete... Startdate: 30/11/2021 Architecture: WINDOWS Score: 68 34 23.253.208.162 RACKSPACEUS United States 2->34 36 51.68.138.110 OVHFR France 2->36 38 2 other IPs or domains 2->38 42 Found malware configuration 2->42 44 Multi AV Scanner detection for submitted file 2->44 46 Yara detected Dridex unpacked file 2->46 48 C2 URLs / IPs found in malware configuration 2->48 9 loaddll32.exe 1 2->9         started        signatures3 process4 process5 11 rundll32.exe 9->11         started        13 cmd.exe 1 9->13         started        15 rundll32.exe 9->15         started        17 4 other processes 9->17 process6 19 WerFault.exe 2 9 11->19         started        22 WerFault.exe 11->22         started        24 rundll32.exe 13->24         started        26 WerFault.exe 9 15->26         started        28 WerFault.exe 9 17->28         started        30 WerFault.exe 9 17->30         started        dnsIp7 40 192.168.2.1 unknown unknown 19->40 32 WerFault.exe 23 9 24->32         started        process8
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a76bc3d7145311be213e3d4ef16a7840208dbf6d354b543c52822dc2ecaa7a6c/
Threat name:
Win32.Trojan.Drixed
Create hunting rule
Status:
Malicious
First seen:
2021-11-29 22:46:32 UTC
File Type:
PE (Dll)
AV detection:
24 of 44 (54.55%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
doppeldridex
Create hunting rule
dridex
Create hunting rule
Similar samples:
137a3b1d2ae58f70052f259434e04a9cbf8d10e54533ef3f9359c03fc4ccb56f
Dridex
26a7de83424d94c22548e9b135d55093525009ed266a919983a7c791a9f35a97
Dridex
bed6059a3a6d51ff59bac895b36eb623a9b0d50b02f01d4ff0c4e37bc7a8bfb2
Dridex
e7c74e4d190b77f63788a032c28c4c4a819edc736697152f0a3e217aba7f5e97
Dridex
ecf60d585aad070feca119d7bfbf3f929c23da7cde1a2e988abd828cee5b8bc5
Dridex
f00b059996a930e014c289a343b2f050bd52108f0a1e32da58fcda3f54ab2ed6
Dridex
f4da618ff77a88dc769e3e6c7c0614a4975ca65b400688ee21233894cd311a0f
Dridex
+ 5'470 additional samples on MalwareBazaar
Result
Malware family:
dridex
Create hunting rule
Score:
  10/10
Tags:
family:dridex botnet:22201 botnet loader
Link:
https://tria.ge/reports/211130-a1rx1sdafm/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Dridex Loader
Dridex
Malware Config
C2 Extraction:
51.68.138.110:443
206.189.150.190:8116
103.109.247.10:10443
23.253.208.162:9217
Unpacked files
SH256 hash:
de7497cd7f629702389e9b425dba4db8886518a6f37bf85819200255c0dab4d4
MD5 hash:
5a3cfbcff76d8e83bee68b80cd42ec59
SHA1 hash:
5f1d0733c7a59fb0d06973414ece0bcae57abb73
Detections:
win_doppeldridex_auto
Create hunting rule
Link:
https://www.unpac.me/results/e9e5de61-b19d-4b87-bc22-bd23e1823d7f/
SH256 hash:
11c32c1c4ebc371679bd4a42621187249aebf9f796c9b2c38bb54d7701c9771e
MD5 hash:
1548250711b2aa68af9879cf8889d67d
SHA1 hash:
9b59687a667eca04f622b0f54c282ced759688ad
Detections:
win_dridex_auto
Create hunting rule
Link:
https://www.unpac.me/results/e9e5de61-b19d-4b87-bc22-bd23e1823d7f/
Parent samples :
a76bc3d7145311be213e3d4ef16a7840208dbf6d354b543c52822dc2ecaa7a6c
ecf60d585aad070feca119d7bfbf3f929c23da7cde1a2e988abd828cee5b8bc5
829f13568010cc4644dadad0f30c41686b4eb5c8c5959502aac3d9a4a47c7dba
SH256 hash:
a76bc3d7145311be213e3d4ef16a7840208dbf6d354b543c52822dc2ecaa7a6c
MD5 hash:
07ceda8350df47b2ef9443985426a9eb
SHA1 hash:
d3ac86c1cc2fb6a3138acb015c58e4b21cdad373
Link:
https://www.unpac.me/results/e9e5de61-b19d-4b87-bc22-bd23e1823d7f/
Malware family:
Dridex
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/a76bc3d71453/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.14
Link:
https://yomi.yoroi.company/submissions/a76bc3d7145311be213e3d4ef16a7840208dbf6d354b543c52822dc2ecaa7a6c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DridexLoader
Create hunting rule
Author:kevoreilly
Description:Dridex v4 dropper C2 parsing function
Rule name:DridexV4
Create hunting rule
Author:kevoreilly
Description:Dridex v4 Payload
Rule name:dridex_loader
Create hunting rule
Author:kevoreilly
Description:Dridex Loader
Rule name:MALWARE_Win_DLLLoader
Create hunting rule
Author:ditekSHen
Description:Detects unknown DLL Loader
Rule name:win_doppeldridex_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.doppeldridex.
Rule name:win_dridex_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.dridex.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Dridex

DLL dll a76bc3d7145311be213e3d4ef16a7840208dbf6d354b543c52822dc2ecaa7a6c

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1833740/
  
Delivery method
Distributed via web download

Comments