🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b21ad8622623ce4bcdbf8c5794ef93e2fb6c46cd202d70dbeb088ea6ca4ff9c8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Dridex


Vendor detections: 10


Intelligence 10 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b21ad8622623ce4bcdbf8c5794ef93e2fb6c46cd202d70dbeb088ea6ca4ff9c8
SHA3-384 hash: 450c8c253c61e68b269943a87d8d9f353cf2be334469702553405a54ceaa5d99f1f550950babfa41aa15f4f897b54867
SHA1 hash: 65cf7f65f443e4bb0e743ccb19105813a12e6eb1
MD5 hash: 0c6889688b060544205620fe1fdbfa4d
humanhash: montana-oklahoma-robert-magazine
File name:b21ad8622623ce4bcdbf8c5794ef93e2fb6c46cd202d70dbeb088ea6ca4ff9c8.bin
Download: download sample
Signature Dridex
Create hunting rule
File size:179'200 bytes
First seen:2021-12-24 19:05:05 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash defff2a6f00707368508735d89d2949e (1 x Dridex)
ssdeep 3072:KqxiTXPCq22FomYeo6o7PjRSeEnYzwEjK9wEiL9zF5YrDg3+krWkVO:Kq6fCeFo76o79LQ6wfwR9fFp
Threatray 5'735 similar samples on MalwareBazaar
TLSH T1A104E071F5CA04E0E59709B9129F5E2F6F35A656160CE0AFC47CE136F89431E06B2A3A
Reporter Arkbird_SOLG
Tags:dll Dridex Grief Ransomware

Intelligence

File Origin
# of uploads :
1
# of downloads :
855
Origin country :
n/a
Vendor Threat Intelligence
Detection:
DridexV4
Create hunting rule
Link:
https://www.capesandbox.com/analysis/216233/
Detection(s):
Win.Ransomware.Grief-9884089-0
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
DNS request
Sending a custom TCP request
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
67%
Tags:
dridex packed ransomware virus yakes
Link:
https://www.filescan.io/uploads/61c619e5ec6c6c14a9efd39e/reports/26bc8f64-a067-4b68-8b24-2b5ca32d2028/overview
Malware family:
Dridex
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/b0a71f4f-dce6-4722-bf64-b3a0bdfa02d0
Result
Threat name:
Unknown
Detection:
malicious
Classification:
n/a
Score:
60 / 100
Link:
https://www.joesandbox.com/analysis/912570
Signature
Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for submitted file
Sigma detected: Suspicious Call by Ordinal
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 545044 Sample: IHlMCRfet8.bin Startdate: 24/12/2021 Architecture: WINDOWS Score: 60 16 Antivirus / Scanner detection for submitted sample 2->16 18 Multi AV Scanner detection for submitted file 2->18 20 Sigma detected: Suspicious Call by Ordinal 2->20 8 loaddll32.exe 1 2->8         started        process3 process4 10 cmd.exe 1 8->10         started        process5 12 rundll32.exe 10->12         started        process6 14 WerFault.exe 23 9 12->14         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b21ad8622623ce4bcdbf8c5794ef93e2fb6c46cd202d70dbeb088ea6ca4ff9c8/
Threat name:
Win32.Infostealer.Dridex
Create hunting rule
Status:
Malicious
First seen:
2021-06-10 09:55:00 UTC
File Type:
PE (Dll)
AV detection:
33 of 43 (76.74%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=winnqyrgephextn7rrlzj34t4l5wyrwneawxbw7lbchknssp7hea._file
Verdict:
malicious
Label(s):
doppeldridex
Create hunting rule
dridex
Create hunting rule
Similar samples:
035b872c1cb731d6df2dfea0c269828c3687c4e543c66d4803d85591f1272f4c
Dridex
8939e276f27575df1ec3ecee791e30c0a46b416ccbfeadc57ec9c94ff97be22e
Dridex
acbcd5ce1579a43148eee9b867f035cd0bc16f237a4790322467a0dac23ce7c6
Dridex
b3e3c4008841cbaaa9a0c26b143f7a7ea1a9b6ec5bd66486a1ce694fba603750
Dridex
b5c6166788cfb3c57723ec0d2c9d95c1c52b8115044574a181cea21fe5deaee4
Dridex
c8341fecb34445b0fb0aea7a560da67979d75d5d4fa85794c00b93d363efd336
Dridex
e4ccdefb2bd1d503e272431baa074774a48f12b8adc68383515aab67b9c08e91
Dridex
+ 5'725 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/211224-xrhpbadhgn/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Unpacked files
SH256 hash:
f0b42691e37db301ba332a00e56a24b8d41b891be28d101c09e84cafc80ff442
MD5 hash:
9fd284d87b00d318f2eabce6fd877235
SHA1 hash:
18ba2e8f85289b1c665fbcf5fc38736b6648fc3b
Detections:
win_dridex_auto
Create hunting rule
Link:
https://www.unpac.me/results/b70d4be8-f4bf-4ff8-9417-0fe2ca026a63/
SH256 hash:
290de2a82ba733e8b77d1315cf23c54de0b4985969d02b16dc69e990f24b2cae
MD5 hash:
6a37412e14518756a0353244715bb68c
SHA1 hash:
472d2e264a9692645053c048ddd2090f500643cd
Detections:
win_doppelpaymer_auto
Create hunting rule
Link:
https://www.unpac.me/results/b70d4be8-f4bf-4ff8-9417-0fe2ca026a63/
SH256 hash:
b21ad8622623ce4bcdbf8c5794ef93e2fb6c46cd202d70dbeb088ea6ca4ff9c8
MD5 hash:
0c6889688b060544205620fe1fdbfa4d
SHA1 hash:
65cf7f65f443e4bb0e743ccb19105813a12e6eb1
Link:
https://www.unpac.me/results/b70d4be8-f4bf-4ff8-9417-0fe2ca026a63/
Malware family:
Dridex
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/b21ad8622623/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/b21ad8622623ce4bcdbf8c5794ef93e2fb6c46cd202d70dbeb088ea6ca4ff9c8

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DridexV4
Create hunting rule
Author:kevoreilly
Description:Dridex v4 Payload
Rule name:MALWARE_Win_DLLLoader
Create hunting rule
Author:ditekSHen
Description:Detects unknown DLL Loader
Rule name:win_doppelpaymer_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.doppelpaymer.
Rule name:win_dridex_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.dridex.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/216233/

Comments