🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bb8481137fc9cc71e49c6a2aefb846091f1810ad9d17b71d64713cda7cb9d3a3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Dridex


Vendor detections: 9


Intelligence 9 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: bb8481137fc9cc71e49c6a2aefb846091f1810ad9d17b71d64713cda7cb9d3a3
SHA3-384 hash: ae7767702b2925faee4441329a7a58d9548e506ab1e699e4305e74fac7341ca45a2934b0faa15bdb6eb011dae189a23c
SHA1 hash: be623ea2c15b6f05b3ad3e46fd04889b9884e8ff
MD5 hash: bcbf7cfae2063ad496330525273af14d
humanhash: oranges-cardinal-nevada-fish
File name:SecuriteInfo.com.Trojan.Dridex.777.23987.11113
Download: download sample
Signature Dridex
Create hunting rule
File size:439'144 bytes
First seen:2021-11-22 20:56:48 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash 3f84747faed4a03ac4a29c71aec18674 (20 x Dridex)
ssdeep 12288:tpY+i26s0+yheTEuvIKRcUDoWdIcgTUEtHkIGixsCCo+pkS:tGtddZwrnzPDgQE6IGIsggkS
Threatray 5'456 similar samples on MalwareBazaar
TLSH T10594B04441876A71F65115F8BEDB3AF2BCB3CC7EF4E05E1D2208489B2F4F15640AA6B6
Reporter SecuriteInfoCom
Tags:dll Dridex signed

Code Signing Certificate

Organisation:STAND ALONE MUSIC LTD
Issuer:Sectigo RSA Code Signing CA
Algorithm:sha256WithRSAEncryption
Valid from:2020-12-07T00:00:00Z
Valid to:2021-12-07T23:59:59Z
Serial number: 3b777165b125bccc181d0bac3f5b55b3
Intelligence: 55 malware samples on MalwareBazaar are signed with this code signing certificate
MalwareBazaar Blocklist:This certificate is on the MalwareBazaar code signing certificate blocklist (CSCB)
Thumbprint Algorithm:SHA256
Thumbprint: f680fab6a9d21e8e76003c5c28b3c5084866d7ac85cf0cfb5aaa02f69ee99f1e
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin
# of uploads :
1
# of downloads :
105
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Detection(s):
SecuriteInfo.com.Trojan.Dridex.777.23987.11113.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
DNS request
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
overlay packed
Link:
https://www.filescan.io/uploads/619c043c398e2553d20137d5/reports/e6a2fba3-3ea7-44e8-a737-a155a3e57a81/overview
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/8c78c4ca-308d-4259-a681-72b93de7ab24
Result
Threat name:
Dridex
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
72 / 100
Link:
https://www.joesandbox.com/analysis/894317
Signature
C2 URLs / IPs found in malware configuration
Found malware configuration
Multi AV Scanner detection for submitted file
Tries to delay execution (extensive OutputDebugStringW loop)
Yara detected Dridex unpacked file
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 526796 Sample: SecuriteInfo.com.Trojan.Dri... Startdate: 23/11/2021 Architecture: WINDOWS Score: 72 39 188.165.214.166 OVHFR France 2->39 41 67.207.95.35 DIGITALOCEAN-ASNUS United States 2->41 43 2 other IPs or domains 2->43 47 Found malware configuration 2->47 49 Multi AV Scanner detection for submitted file 2->49 51 Yara detected Dridex unpacked file 2->51 53 C2 URLs / IPs found in malware configuration 2->53 9 loaddll32.exe 1 2->9         started        signatures3 process4 process5 11 rundll32.exe 9->11         started        14 rundll32.exe 9->14         started        16 rundll32.exe 9->16         started        18 4 other processes 9->18 signatures6 55 Tries to delay execution (extensive OutputDebugStringW loop) 11->55 20 WerFault.exe 9 11->20         started        22 WerFault.exe 14->22         started        25 WerFault.exe 14->25         started        27 WerFault.exe 16->27         started        29 WerFault.exe 16->29         started        31 rundll32.exe 18->31         started        33 WerFault.exe 9 18->33         started        35 WerFault.exe 9 18->35         started        process7 dnsIp8 45 192.168.2.1 unknown unknown 22->45 37 WerFault.exe 23 9 31->37         started        process9
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/bb8481137fc9cc71e49c6a2aefb846091f1810ad9d17b71d64713cda7cb9d3a3/
Threat name:
Win32.Trojan.Drixed
Create hunting rule
Status:
Malicious
First seen:
2021-11-22 17:31:19 UTC
File Type:
PE (Dll)
AV detection:
17 of 28 (60.71%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
doppeldridex
Create hunting rule
dridex
Create hunting rule
Similar samples:
2dd54462c65a469a2611be091d84fa71a4c1b5b61d020f4058296153941d9e13
Dridex
c1194b3b9e8e8900d6010d77874ad396c67272a57d526db7d21887a90bcbdbe4
Dridex
cc31d1c3648d35d98c16d49ff17e290b07f431ccd23434b50c905c2aa4ba8f38
Dridex
ddcaa1c7ba38d83e0f34da7cce150905cd0246f15334b9feadd8dcab5cd991ee
Dridex
ed8defd4e1e81fbc877f7419d6593303403504f4ea02de07085ea94d6ad78e18
Dridex
ee1259ba7e41be5e8f11fb7ed2fb983bd9a48e757cf59690336aa63ac2497dba
Dridex
f4f0127923c4a1c69aab04516907fd4010f9af8302e132b972d053813577b18d
Dridex
+ 5'446 additional samples on MalwareBazaar
Result
Malware family:
dridex
Create hunting rule
Score:
  10/10
Tags:
family:dridex botnet:22203 botnet loader
Link:
https://tria.ge/reports/211122-zrlgbabhg5/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Dridex Loader
Dridex
Malware Config
C2 Extraction:
67.207.95.35:443
86.107.98.232:8333
188.165.214.166:4664
144.91.110.219:9217
Unpacked files
SH256 hash:
78c6a6e835d10c6eb61421e0d7a7df958dfab37974fa9b71c40cedfa09317be6
MD5 hash:
5e5c5a2ee5b77339ab395cf074d874a1
SHA1 hash:
d1a131933439404bf44fc6f494862745c9a4d213
Detections:
win_dridex_auto
Create hunting rule
Link:
https://www.unpac.me/results/fe73cd94-652e-46ba-80d0-1bc51c6f4ae8/
Parent samples :
f46403b87fbf1cf29998b7a5675b8e45903c380ed3765bbf4157efe552d652f9
97b0ac9dc97eb0778dce6676ce9872ce8b621ee3d7e7c4e00c642d033d7dfbae
f03f91696ce0ddd77a4f220753ab3aa8c838d18b4f55824143a5071a9d32d1c0
ed8defd4e1e81fbc877f7419d6593303403504f4ea02de07085ea94d6ad78e18
6aece6407d065eb07920b284b3175a6153bba568041b2cab4bdfcb0873577ea6
061f776afbe47244a114d956480c3371112b36ae3efaa679a730f9de465695b2
e223980a1fd0ad2f6674019e1f65113c30df79896ae08606eebfa2bcd56e982e
9cc73deb20bce4f6ddb48e575925d7eb583a34cfefb5635f3eb68954b8f4c75d
9a63b8546df4310d75234a37dabecb0e231876f897207e62e36831d08c0e7ac6
c9245778a049dc7e57228e0846f00ede4a62d779102772b628ba733beb2d149c
0ab7fef04ca81bddf9b7a2b17e7219fcaf4ee62836d614acbe17292223c88e49
ef626b3e8d15c5fd15664bdda8701891bb19e4fb9e1b746e6cecad30020fd944
bb8481137fc9cc71e49c6a2aefb846091f1810ad9d17b71d64713cda7cb9d3a3
c1194b3b9e8e8900d6010d77874ad396c67272a57d526db7d21887a90bcbdbe4
0588d2621f476d4941a35886ba99a3cbcfd2011eed2c1e4e9a5ff47e49b84b73
662c99fdb844c93db6fe5456e6e59f3eca80dbf092ced26e9256dc9e990f1455
4366aaaa7bf44ed9e1b3689574f32a8ed7cfc7cd5ebcf65b22478e9db5f91086
c3907ae9386019e97403c436ccd59a9486cfa62983dd9fda4c5a46fb0c19cf6f
42e4a419e9983ff24668de02908e95d3e4816c34e201811bc34d4b221dc11751
254bc968237a6e965cc06d4761818de91d9c8373a0d48a25d5b707081c975d75
SH256 hash:
9592e2b56d8d3187eae36b00417b19bf146514ae0350fd751461b64273f75faa
MD5 hash:
c560ba18cd2914dafd0cc479e2c28d4f
SHA1 hash:
ed9d5285f568338ce938e6d4aad71a04c5737705
Detections:
win_doppeldridex_auto
Create hunting rule
Link:
https://www.unpac.me/results/fe73cd94-652e-46ba-80d0-1bc51c6f4ae8/
Parent samples :
97b0ac9dc97eb0778dce6676ce9872ce8b621ee3d7e7c4e00c642d033d7dfbae
c9245778a049dc7e57228e0846f00ede4a62d779102772b628ba733beb2d149c
bb8481137fc9cc71e49c6a2aefb846091f1810ad9d17b71d64713cda7cb9d3a3
42e4a419e9983ff24668de02908e95d3e4816c34e201811bc34d4b221dc11751
SH256 hash:
bb8481137fc9cc71e49c6a2aefb846091f1810ad9d17b71d64713cda7cb9d3a3
MD5 hash:
bcbf7cfae2063ad496330525273af14d
SHA1 hash:
be623ea2c15b6f05b3ad3e46fd04889b9884e8ff
Link:
https://www.unpac.me/results/fe73cd94-652e-46ba-80d0-1bc51c6f4ae8/
Malware family:
Dridex
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/bb8481137fc9/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/bb8481137fc9cc71e49c6a2aefb846091f1810ad9d17b71d64713cda7cb9d3a3

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Sectigo_Code_Signed
Create hunting rule
Description:Detects code signed by the Sectigo RSA Code Signing CA
Reference:https://bazaar.abuse.ch/export/csv/cscb/
Rule name:Sectigo_Code_Signed
Create hunting rule
Description:Detects code signed by the Sectigo RSA Code Signing CA
Reference:https://bazaar.abuse.ch/export/csv/cscb/

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Dridex

DLL dll bb8481137fc9cc71e49c6a2aefb846091f1810ad9d17b71d64713cda7cb9d3a3

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1806281/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/208400/

Comments