🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 af8fda4ee7c3a1a2fa35e6feb4416de3d9ff6b1869df2b1550557f96c49c45e5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Dridex


Vendor detections: 11


Intelligence 11 IOCs YARA 6 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: af8fda4ee7c3a1a2fa35e6feb4416de3d9ff6b1869df2b1550557f96c49c45e5
SHA3-384 hash: ef5ec18b9ad4ec98541227a8e2eeea6819f0e89c918123783432ae2fdc3704d3fc5db7882ce2715496d01b6a5575cb7b
SHA1 hash: 9b2f4a3941a9cf48254987c63fa17e2a0bf4917e
MD5 hash: bb84035876ade695788729a307e7b72c
humanhash: moon-paris-texas-berlin
File name:SecuriteInfo.com.Variant.Zusy.410517.7.1613
Download: download sample
Signature Dridex
Create hunting rule
File size:520'192 bytes
First seen:2021-12-16 20:49:51 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash 52e2fdaab9e6e0c66f8ede7c1e947cfb (4 x Dridex)
ssdeep 12288:qcuO7BnvXnZJ1jNPRfQISExuQlQMA/LG1nbKig1GbaJBhfSQYm9Q7JijTp9A9B2/:KQQISEzA/LG1nbKig1GbaJBhfSQYm9Qq
Threatray 5'616 similar samples on MalwareBazaar
TLSH T1B7B4AFE5008B1341E65717BB56925E1FE5269CAE6961FF03F808FA3F702CA68F970706
Reporter SecuriteInfoCom
Tags:dll Dridex

Intelligence

File Origin
# of uploads :
1
# of downloads :
204
Origin country :
n/a
Vendor Threat Intelligence
Detection:
DridexV4
Create hunting rule
Link:
https://www.capesandbox.com/analysis/214681/
Detection(s):
SecuriteInfo.com.Variant.Zusy.410517.7.1613.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
DNS request
Sending a custom TCP request
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/61bba6818541392eb4eb16b9/reports/4d2ace59-254c-45d5-907d-d13d45e2f69a/overview
Malware family:
Dridex
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/0c230744-6aff-4b96-b2d6-8eef5d6a3f77
Result
Threat name:
Dridex
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
76 / 100
Link:
https://www.joesandbox.com/analysis/908780
Signature
C2 URLs / IPs found in malware configuration
Found malware configuration
Multi AV Scanner detection for submitted file
Sigma detected: Suspicious Call by Ordinal
Tries to delay execution (extensive OutputDebugStringW loop)
Yara detected Dridex unpacked file
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 541258 Sample: SecuriteInfo.com.Variant.Zu... Startdate: 16/12/2021 Architecture: WINDOWS Score: 76 22 89.31.56.58 UNITHOST-ASNL Netherlands 2->22 24 51.159.52.196 OnlineSASFR France 2->24 26 2 other IPs or domains 2->26 28 Found malware configuration 2->28 30 Multi AV Scanner detection for submitted file 2->30 32 Yara detected Dridex unpacked file 2->32 34 2 other signatures 2->34 9 loaddll32.exe 1 2->9         started        signatures3 process4 signatures5 36 Tries to delay execution (extensive OutputDebugStringW loop) 9->36 12 cmd.exe 1 9->12         started        14 rundll32.exe 9->14         started        process6 process7 16 rundll32.exe 12->16         started        18 WerFault.exe 9 14->18         started        process8 20 WerFault.exe 23 9 16->20         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/af8fda4ee7c3a1a2fa35e6feb4416de3d9ff6b1869df2b1550557f96c49c45e5/
Threat name:
Win32.Infostealer.Dridex
Create hunting rule
Status:
Malicious
First seen:
2021-12-16 18:12:10 UTC
File Type:
PE (Dll)
AV detection:
17 of 27 (62.96%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=v6h5utxhyoq2f6rv437liqln4pm762yynhpswfkqkv7znre4ixsq._file
Verdict:
malicious
Label(s):
doppeldridex
Create hunting rule
dridex
Create hunting rule
Similar samples:
01c3b24353de26b5638d7d9462b83d1b68448c4a0019be14aaa1dc60a09cd491
Dridex
492fe6caf5e12dcb484f636079c246fbf0ab4b8ed59e8e5a61131dbd1fd4d2be
Dridex
6477f31e018582791a793ff0c0273f9f2b43139c0b25a88772cb90a72111f6bb
Dridex
82401c527367babbab2dd52ae4e93b3d3085264a20c58a40c6d5ebfae4ff7a12
Dridex
98058909fe77d37d42c642f2dc103f417cff699c75b96aa829058cd286edcdef
Dridex
b5c6166788cfb3c57723ec0d2c9d95c1c52b8115044574a181cea21fe5deaee4
Dridex
fa6aea596a04b6bd957babd156bbd40cafa2b0662390cc2fd30953fb48ec61fc
Dridex
+ 5'606 additional samples on MalwareBazaar
Result
Malware family:
dridex
Create hunting rule
Score:
  10/10
Tags:
family:dridex botnet:22202 botnet loader
Link:
https://tria.ge/reports/211216-zmllhschc6/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Dridex Loader
Dridex
Malware Config
C2 Extraction:
51.159.52.196:443
134.209.247.135:6602
194.233.68.48:5228
89.31.56.58:593
Unpacked files
SH256 hash:
04881c7493210e832171047250ff9a9b4653aef2aa679930bdc33677157d1cb7
MD5 hash:
8cc346e72a3e8b95fe3036a8365cbcb0
SHA1 hash:
971759a2f2c1fc176f9498b92be83c32ad6cd381
Detections:
win_doppeldridex_auto
Create hunting rule
Link:
https://www.unpac.me/results/f144eb0b-2ab6-41bb-a5fb-ada7371c71e5/
Parent samples :
50761739346818e0762dfc39da6cf287bef4f58f6b0290f0d450571b26099d12
af8fda4ee7c3a1a2fa35e6feb4416de3d9ff6b1869df2b1550557f96c49c45e5
SH256 hash:
6bd6aa840865dfc286fb69d575b51385b01723a98e02f20b4e6a9bac4534be75
MD5 hash:
8983a78913bafc9cc0d121b91775cbf2
SHA1 hash:
6860bb2ec5470398a768d1a40e40c4ad3a42c2b8
Detections:
win_dridex_auto
Create hunting rule
Link:
https://www.unpac.me/results/f144eb0b-2ab6-41bb-a5fb-ada7371c71e5/
Parent samples :
d611d87fdbb41df49c42e15b1b310aea6ea941c97c56c20025ff9b7ea7f3d0f1
50761739346818e0762dfc39da6cf287bef4f58f6b0290f0d450571b26099d12
af8fda4ee7c3a1a2fa35e6feb4416de3d9ff6b1869df2b1550557f96c49c45e5
2da4bed861ca469094691ec2fe93b0d193873e9078004a7289002fd99c81c743
SH256 hash:
af8fda4ee7c3a1a2fa35e6feb4416de3d9ff6b1869df2b1550557f96c49c45e5
MD5 hash:
bb84035876ade695788729a307e7b72c
SHA1 hash:
9b2f4a3941a9cf48254987c63fa17e2a0bf4917e
Link:
https://www.unpac.me/results/f144eb0b-2ab6-41bb-a5fb-ada7371c71e5/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.96
Link:
https://yomi.yoroi.company/submissions/af8fda4ee7c3a1a2fa35e6feb4416de3d9ff6b1869df2b1550557f96c49c45e5

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DridexLoader
Create hunting rule
Author:kevoreilly
Description:Dridex v4 dropper C2 parsing function
Rule name:DridexV4
Create hunting rule
Author:kevoreilly
Description:Dridex v4 Payload
Rule name:dridex_loader
Create hunting rule
Author:kevoreilly
Description:Dridex Loader
Rule name:MALWARE_Win_DLLLoader
Create hunting rule
Author:ditekSHen
Description:Detects unknown DLL Loader
Rule name:win_doppeldridex_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.doppeldridex.
Rule name:win_dridex_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.dridex.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Dridex

DLL dll af8fda4ee7c3a1a2fa35e6feb4416de3d9ff6b1869df2b1550557f96c49c45e5

(this sample)

Cape
Cape
https://www.capesandbox.com/analysis/214681/
  
URLhaus
https://urlhaus.abuse.ch/url/1891164/
  
Delivery method
Distributed via web download

Comments