🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b86731e235e2e628d9ddfda63dfd59df5266b069531e81e8a67e56ee3798190f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Dridex


Vendor detections: 10


Intelligence 10 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b86731e235e2e628d9ddfda63dfd59df5266b069531e81e8a67e56ee3798190f
SHA3-384 hash: 5564427ec7deeaad26625744e290f7851428eeda147ce1654c501be4fb3361e5dc5082e837f3d6215a8e261dcc6f4ae4
SHA1 hash: 31333a74875e85a4b09c84d3c58ce7dfa9981e47
MD5 hash: 2f1b05a2e8d597bf81d4cd8068715932
humanhash: beryllium-bluebird-sixteen-tango
File name:SecuriteInfo.com.Variant.Lazy.89658.9069.29835
Download: download sample
Signature Dridex
Create hunting rule
File size:524'288 bytes
First seen:2021-12-16 20:49:56 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash 2a48248992aa49f57391a72b3d033ef5 (1 x Dridex)
ssdeep 6144:5jYzZ7WCw5bkTSCUBRWvFLCwenfKFk74BnYwd2kquSmsmQqQWyWQ+WcQUS+wOQm2:Re+kYWzenfUksBYkhrN/DZ/VFHXV1
Threatray 5'616 similar samples on MalwareBazaar
TLSH T130B4AFAC6FCF93D0E12627B95D2C4076DA1DA728B760FBFA75314E6784D4B6230D2122
Reporter SecuriteInfoCom
Tags:dll Dridex

Intelligence

File Origin
# of uploads :
1
# of downloads :
157
Origin country :
n/a
Vendor Threat Intelligence
Detection:
DridexV4
Create hunting rule
Link:
https://www.capesandbox.com/analysis/214682/
Detection(s):
SecuriteInfo.com.Variant.Lazy.89658.9069.29835.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
DNS request
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/61bba6838541392eb4eb16bb/reports/cb162a8b-12ae-4b16-b49d-ef9ddfa43b3f/overview
Malware family:
Dridex
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/917d2a20-8fce-4c37-b3be-c65d55a143b3
Result
Threat name:
Dridex
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
76 / 100
Link:
https://www.joesandbox.com/analysis/908779
Signature
C2 URLs / IPs found in malware configuration
Found malware configuration
Multi AV Scanner detection for submitted file
Sigma detected: Suspicious Call by Ordinal
Tries to delay execution (extensive OutputDebugStringW loop)
Yara detected Dridex unpacked file
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 541257 Sample: SecuriteInfo.com.Variant.La... Startdate: 16/12/2021 Architecture: WINDOWS Score: 76 22 89.31.56.58 UNITHOST-ASNL Netherlands 2->22 24 51.159.52.196 OnlineSASFR France 2->24 26 2 other IPs or domains 2->26 28 Found malware configuration 2->28 30 Multi AV Scanner detection for submitted file 2->30 32 Yara detected Dridex unpacked file 2->32 34 2 other signatures 2->34 9 loaddll32.exe 1 2->9         started        signatures3 process4 signatures5 36 Tries to delay execution (extensive OutputDebugStringW loop) 9->36 12 cmd.exe 1 9->12         started        14 rundll32.exe 9->14         started        process6 process7 16 rundll32.exe 12->16         started        18 WerFault.exe 9 14->18         started        process8 20 WerFault.exe 23 9 16->20         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b86731e235e2e628d9ddfda63dfd59df5266b069531e81e8a67e56ee3798190f/
Threat name:
Win32.Infostealer.Dridex
Create hunting rule
Status:
Malicious
First seen:
2021-12-16 20:35:28 UTC
File Type:
PE (Dll)
AV detection:
16 of 27 (59.26%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
doppeldridex
Create hunting rule
dridex
Create hunting rule
Similar samples:
2277b7c1b0c715b93395bb6f616d99c7bf5ad8a08236a098d50849267043f2bd
Dridex
4f89bc940e3e26925bd237275e91e979cd3f930ccf7689102ecf74e877f413bb
Dridex
4ff524afd1a400a671e67a3cae5d582bf9c1ea927f430b0b5debc73302c4865f
Dridex
5de9a2fb4b9a65e5b48d78ed6a09e6cbdca07d30e917b5777be56d7c2e7acc0e
Dridex
c7115f02b6d2829d45505aa1a9a6e1978d00f57c0180873fa859c29d2d088a66
Dridex
e203ff7d35dd31b84a42961aaf43f7887980469247822c4acb0cfc53be5274ff
Dridex
e44b1a6a58dd89fec8005134c68ae75278904f51f91ecdabc66e59eaf258bb8c
Dridex
fbdbb2388792309d00ba8f6869ff5cc3b7c34097084fef10a0f529153cf83948
Dridex
+ 5'606 additional samples on MalwareBazaar
Result
Malware family:
dridex
Create hunting rule
Score:
  10/10
Tags:
family:dridex botnet:22201 botnet loader
Link:
https://tria.ge/reports/211216-zmllhsdefp/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Dridex Loader
Dridex
Suspicious use of NtCreateProcessExOtherParentProcess
Malware Config
C2 Extraction:
51.159.52.196:443
134.209.247.135:6602
194.233.68.48:5228
89.31.56.58:593
Unpacked files
SH256 hash:
b86731e235e2e628d9ddfda63dfd59df5266b069531e81e8a67e56ee3798190f
MD5 hash:
2f1b05a2e8d597bf81d4cd8068715932
SHA1 hash:
31333a74875e85a4b09c84d3c58ce7dfa9981e47
Link:
https://www.unpac.me/results/983f20fc-59f9-40c4-a5ec-29f44863de5a/
Malware family:
Dridex
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/b86731e235e2/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.96
Link:
https://yomi.yoroi.company/submissions/b86731e235e2e628d9ddfda63dfd59df5266b069531e81e8a67e56ee3798190f

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Dridex

DLL dll b86731e235e2e628d9ddfda63dfd59df5266b069531e81e8a67e56ee3798190f

(this sample)

Cape
Cape
https://www.capesandbox.com/analysis/214682/
  
URLhaus
https://urlhaus.abuse.ch/url/1891045/
  
Delivery method
Distributed via web download

Comments