🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b2b43eefd7ae4cedb7d504f44ccdba410d0465017a92becfbc9730e57893671d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Dridex


Vendor detections: 9


Intelligence 9 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b2b43eefd7ae4cedb7d504f44ccdba410d0465017a92becfbc9730e57893671d
SHA3-384 hash: bb1998d49a26df7891165e2ede5af92c5174f13feaebf584a73c0c2f3216068916ab99881d3084fdc7fd22eff9f8488a
SHA1 hash: 8d57dcc480124967f2e286bcff84d030148da680
MD5 hash: ac29dcd7fd74816cd403eafbffef42ef
humanhash: avocado-uranus-white-kansas
File name:Dridex dll (12)
Download: download sample
Signature Dridex
Create hunting rule
File size:663'552 bytes
First seen:2021-11-17 15:09:57 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash 6ee6d183d3880a500fe4c20e1521f405 (17 x Dridex)
ssdeep 12288:SyDgTeyLeMTeGPeWnyyju+JUEleC5MK5q6JeY/eeFeajgcNagjycdeajOqHeiZWo:SIgayCMaGWWyyi+eEoCGKE68YGeIaEcn
Threatray 5'340 similar samples on MalwareBazaar
TLSH T1B1E4BF94A4DAB6CFD613DB75A4F1E7878C7E184CC2304FAEC052C69990E4B95023E79B
Reporter JAMESWT_WT
Tags:dll Dridex

Intelligence

File Origin
# of uploads :
1
# of downloads :
165
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Detection(s):
SecuriteInfo.com.Variant.Symmi.79823.285.7647.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
DNS request
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/61951b574912a8c920a18732/reports/ef238096-a23f-436d-8315-ad79f72c1d45/overview
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/d0f72466-a39f-413a-9224-1231f0e7710d
Result
Threat name:
Dridex
Create hunting rule
Detection:
malicious
Classification:
troj
Score:
72 / 100
Link:
https://www.joesandbox.com/analysis/891361
Signature
C2 URLs / IPs found in malware configuration
Found malware configuration
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Yara detected Dridex unpacked file
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 523834 Sample: Dridex dll (12) Startdate: 17/11/2021 Architecture: WINDOWS Score: 72 17 54.37.70.105 OVHFR France 2->17 19 142.93.218.86 DIGITALOCEAN-ASNUS United States 2->19 21 2 other IPs or domains 2->21 23 Found malware configuration 2->23 25 Multi AV Scanner detection for submitted file 2->25 27 Yara detected Dridex unpacked file 2->27 29 2 other signatures 2->29 9 loaddll32.exe 1 2->9         started        signatures3 process4 process5 11 cmd.exe 1 9->11         started        process6 13 rundll32.exe 11->13         started        process7 15 WerFault.exe 23 9 13->15         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b2b43eefd7ae4cedb7d504f44ccdba410d0465017a92becfbc9730e57893671d/
Threat name:
Win32.Trojan.Drixed
Create hunting rule
Status:
Malicious
First seen:
2021-11-17 15:10:13 UTC
AV detection:
15 of 44 (34.09%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=wk2d536xvzgo3n6vat2eztn2iegqizibpkjl5t54s4yok6etm4oq._file
Verdict:
malicious
Label(s):
doppeldridex
Create hunting rule
dridex
Create hunting rule
Similar samples:
10e5f3b96a81bb3b849a9dbba33d6f297d38b417e7d6269fbcff0ce876dcb47e
Dridex
23dbff4b60095055eba4951fc104c9988379b1d3442c9e5bc0592a05c3a01de7
Dridex
2838421699d06344ca689b1dcf11777581c15a3302eb9ef801081c340335892c
Dridex
362e03f5f1194bcc16cfc14bd64662e9a715edf9458006804cc7b69e63c61941
Dridex
5d2ab3a55ea082117d480a9ec3461a96f831b2107ffdf57c1385f8ab2c4f31d0
Dridex
69741e9ae94870e00669dfede5b502b3051ce3d73e688e99d2025506469b9ab4
Dridex
76772af43f50edd471246d7840b25497825b6538b78ea66d1d5928631ffdfe85
Dridex
88e28fd812e1c5056067dfa50d21ca28d66b4c419c1bb0d2af27309b9fcd682e
Dridex
8e1aef426727d6b526d31cf86a7d9269164a6fb3e22b1cedfbf787ce927b35c3
Dridex
e8ee4909eebec883590b2d1ab49d1e0f4c9e6667accd687032e2d67d99c0d953
Dridex
+ 5'330 additional samples on MalwareBazaar
Result
Malware family:
dridex
Create hunting rule
Score:
  10/10
Tags:
family:dridex botnet:22202 botnet loader
Link:
https://tria.ge/reports/211117-sj21rsdbb2/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Dridex Loader
Dridex
Malware Config
C2 Extraction:
54.37.70.105:443
198.199.70.22:6602
164.68.99.3:5007
142.93.218.86:4664
Unpacked files
SH256 hash:
dcf443c687fc485570f7de858804fcbc172c4a871c6f33e3a6b6c3892fa44958
MD5 hash:
f87df97267b7905212ae7d7aa62b49af
SHA1 hash:
8928cd2b3ae530d60ac3027bc201a86c83b11330
Detections:
win_dridex_auto
Create hunting rule
Link:
https://www.unpac.me/results/179c7c12-270d-45b5-af63-d212bee0aaa1/
Parent samples :
8b2184353867867d1c6b3a9e93d79a3120a726cbeb695a1f215cb55acd4b0453
69741e9ae94870e00669dfede5b502b3051ce3d73e688e99d2025506469b9ab4
88e28fd812e1c5056067dfa50d21ca28d66b4c419c1bb0d2af27309b9fcd682e
23dbff4b60095055eba4951fc104c9988379b1d3442c9e5bc0592a05c3a01de7
2838421699d06344ca689b1dcf11777581c15a3302eb9ef801081c340335892c
e8ee4909eebec883590b2d1ab49d1e0f4c9e6667accd687032e2d67d99c0d953
362e03f5f1194bcc16cfc14bd64662e9a715edf9458006804cc7b69e63c61941
ead4628c8fa616f6d9c54cfd4351942693ca978fc273b34917c4055b1418f538
8e1aef426727d6b526d31cf86a7d9269164a6fb3e22b1cedfbf787ce927b35c3
b2b43eefd7ae4cedb7d504f44ccdba410d0465017a92becfbc9730e57893671d
10e5f3b96a81bb3b849a9dbba33d6f297d38b417e7d6269fbcff0ce876dcb47e
4b156a5377a6c50e046dfdad0699fe26946a4e72f83fb602f95f61e50116d614
5d2ab3a55ea082117d480a9ec3461a96f831b2107ffdf57c1385f8ab2c4f31d0
c85f3aabe5c9efaa175ba9f18dc7b14a86a0aeb6206a78dbc01b9f4aef45ca1e
65c6aef17acd34ac4cda6b90182ee7d85ecdfca18532db4f5007df51519ea7ef
76772af43f50edd471246d7840b25497825b6538b78ea66d1d5928631ffdfe85
834a8705f44eec48b042c99b0ae27caffa3bec191e6269fbf0bfd6675a44f20e
SH256 hash:
00db1d41ae6d59959bf7c74e49bd6c46deff393f555a953570e59ff074bf0bcc
MD5 hash:
9dd7f9cfc49735f2022147b33ba59087
SHA1 hash:
b6b76719ea1630ef85e33b97a4bff77cbc34c7b0
Detections:
win_doppeldridex_auto
Create hunting rule
Link:
https://www.unpac.me/results/179c7c12-270d-45b5-af63-d212bee0aaa1/
SH256 hash:
b2b43eefd7ae4cedb7d504f44ccdba410d0465017a92becfbc9730e57893671d
MD5 hash:
ac29dcd7fd74816cd403eafbffef42ef
SHA1 hash:
8d57dcc480124967f2e286bcff84d030148da680
Link:
https://www.unpac.me/results/179c7c12-270d-45b5-af63-d212bee0aaa1/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Dridex
Score:
0.90
Link:
https://yomi.yoroi.company/submissions/b2b43eefd7ae4cedb7d504f44ccdba410d0465017a92becfbc9730e57893671d

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Dridex

DLL dll b2b43eefd7ae4cedb7d504f44ccdba410d0465017a92becfbc9730e57893671d

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1797610/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/206891/

Comments