🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bc9379090bc8de95b1f765cd41ddd45043e2fdceb86ed2dd0e4d988600baae85. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Dridex


Vendor detections: 9


Intelligence 9 IOCs YARA File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: bc9379090bc8de95b1f765cd41ddd45043e2fdceb86ed2dd0e4d988600baae85
SHA3-384 hash: b4141b28f03964e3f3772122f1c7f9c58508ddcee332017efd2a64ffdcd552b49a433be39ce3fee304a2650ed5a42586
SHA1 hash: 8843599ba312e4842ca139157fe48aed18d7696b
MD5 hash: 8b22323e8a0b8bf647766c2343edc45b
humanhash: sweet-winner-football-social
File name:8b22323e8a0b8bf647766c2343edc45b
Download: download sample
Signature Dridex
Create hunting rule
File size:536'576 bytes
First seen:2021-12-13 19:13:10 UTC
Last seen:2021-12-13 21:57:47 UTC
File type:DLL dll
MIME type:application/x-dosexec
imphash e9192d34e4c9dcdf739aaa1d74025eb2 (27 x Dridex)
ssdeep 6144:zKMImhktm7mnmvetmzK/kxwv4Zm7mREqZzdazdULd54f3X0kdVtL8faGAPlX:z9hXAg5aX0CL8fI
TLSH T192B4B0D1F05FE94AFA5E46712E18D932D45E0B03A3A6BB787623402C66DD3253CD2B72
Reporter zbetcheckin
Tags:32 dll Dridex exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
146
Origin country :
n/a
Vendor Threat Intelligence
Detection:
DridexV4
Create hunting rule
Link:
https://www.capesandbox.com/analysis/213671/
Detection(s):
SecuriteInfo.com.W32.AIDetect.malware1.4120.17976.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
DNS request
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
greyware packed
Link:
https://www.filescan.io/uploads/61b79b7c47bb875c085b222c/reports/c10afa05-a15e-4b45-aac3-d678d0bc4d2a/overview
Malware family:
Dridex
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/056f9605-dca1-49c0-b94e-821b4abd9879
Result
Threat name:
Dridex
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
80 / 100
Link:
https://www.joesandbox.com/analysis/906594
Signature
C2 URLs / IPs found in malware configuration
Found malware configuration
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Sigma detected: Suspicious Call by Ordinal
Tries to delay execution (extensive OutputDebugStringW loop)
Yara detected Dridex unpacked file
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 539072 Sample: yfSLSTNYoU Startdate: 13/12/2021 Architecture: WINDOWS Score: 80 22 162.241.33.132 UNIFIEDLAYER-AS-1US United States 2->22 24 217.160.5.104 ONEANDONE-ASBrauerstrasse48DE Germany 2->24 26 2 other IPs or domains 2->26 28 Found malware configuration 2->28 30 Multi AV Scanner detection for submitted file 2->30 32 Yara detected Dridex unpacked file 2->32 34 3 other signatures 2->34 9 loaddll32.exe 1 2->9         started        signatures3 process4 signatures5 36 Tries to delay execution (extensive OutputDebugStringW loop) 9->36 12 cmd.exe 1 9->12         started        14 rundll32.exe 9->14         started        process6 process7 16 rundll32.exe 12->16         started        18 WerFault.exe 9 14->18         started        process8 20 WerFault.exe 23 9 16->20         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/bc9379090bc8de95b1f765cd41ddd45043e2fdceb86ed2dd0e4d988600baae85/
Threat name:
Win32.Trojan.GenericML
Create hunting rule
Status:
Malicious
First seen:
2021-12-13 19:14:09 UTC
File Type:
PE (Dll)
AV detection:
21 of 28 (75.00%)
Threat level:
  5/5
Result
Malware family:
dridex
Create hunting rule
Score:
  10/10
Tags:
family:dridex botnet:22201 botnet loader
Link:
https://tria.ge/reports/211213-xxmv8aeah3/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Dridex Loader
Dridex
Malware Config
C2 Extraction:
104.36.167.47:443
188.40.48.93:4664
162.241.33.132:9217
217.160.5.104:593
Unpacked files
SH256 hash:
48d3a64c501f161c1436933c5f98dea6911f88a48ec445eada05f67e87c1d78d
MD5 hash:
1b22f613a65698007fe993b30d43ab5e
SHA1 hash:
7bb2291535ce8e20094d762e9535e4dc68db469f
Detections:
win_dridex_auto
Create hunting rule
Link:
https://www.unpac.me/results/5ba8517f-a766-4299-8878-656feb0c1a87/
Parent samples :
ddb7acdcdb339543380bcb3d4633248ffe20e555104b26999a4c2ae2a40dfa14
7a26d1b438379d5d2aab546f7753bd4df2593680755e8595bfa11dce1ccc1c12
765b54b871cee0938ec705329d96c028d64fdd3234182060333415613b7eb7f4
bc9379090bc8de95b1f765cd41ddd45043e2fdceb86ed2dd0e4d988600baae85
104f26193555cb12c6738ed0fdddf4fb609c241b75192ec24856d077a3ca490e
afd3d540c9806ec47ae8e234368b513b16265e33ca487b9c54e1e435d70aaea0
02b4e73080d8846e3a1e57a00f0f332a68df4355d14be50811f62c50f03830c2
5c17631af38e9a8910015e2ca160a7d9505c9ca8863be9258b3e30411301a03f
3ccdc391b7cab2de27453c65ce062cda1f4020d110ff4c20323484f9910507e7
c93073bdd03e0b2771da3997ba7fe5aff86edf2c682d70b5be4bd3d2d30ee5b1
2188ba59be5637dbc7e38dbf6eb379d43a1c62eaa3301cbfc680b02c5a36c023
ba01a2cb78c39adf8042c658ac9c193a663e7f3311864763dd2b8ba400a93249
b24c3ed00e59dbcff18037648cad503072b9e0d7a13f30d2bbfa9c466fdbee66
59ac15b6de9e5065e58ccc24797e3bb36e2a4eb4348e83979781cc880a3456c0
3aab8f6eca123b1fc8184caa6ad3320ac6c9f58cd73835fac41feef05053abff
de4ced01e9e13a297adb61c70746296d1e22b3d09cf7534f9ebdb16e82684823
32f8a7972ce0593b753c37f18cce172e3ca2fdca15a0ea6ae6f392fd388a2e20
e8b40e350941513e25125bda776582af0ab862f06648792424c924d1dc001875
65a5017e05c78e8fa52197912f8b1003e06071321ec1b46859f8581d372d2959
6477f31e018582791a793ff0c0273f9f2b43139c0b25a88772cb90a72111f6bb
492fe6caf5e12dcb484f636079c246fbf0ab4b8ed59e8e5a61131dbd1fd4d2be
a7919340edfbafcf10751579a93ee23b1fe864d9680d553bd254422d14ffeeb0
bf3130e116fd5d9ae43a09831d59f66acee6cb0de1d657e80e711a2bb6397408
95d1beab5c48ef14f201aa49b734444ecc9dc9516d950f4c3cef8eadc0d9fbba
0341b7e0b66e27bee166ba1fd9fad700d85e58a257bbfed1b60a662d97fc1617
1bd2e431f2631a5bfc21a9e244bb28d4230dad825b9d6396afcd32458923fb0a
e4db910a4147ac44bef76f71e6b0d6bd193b89a6268dda35f3b1c210cc111fe4
48d3a64c501f161c1436933c5f98dea6911f88a48ec445eada05f67e87c1d78d
SH256 hash:
b7436a631b5abfb4cab1a197ffacb9dff280ec9b2f0365b6c53e36da03ac5b63
MD5 hash:
f1a224db6b425b41ffe946f59066a85f
SHA1 hash:
06f25a3bd064df80170cc2a732c7b3a5bcf37888
Detections:
win_doppeldridex_auto
Create hunting rule
Link:
https://www.unpac.me/results/5ba8517f-a766-4299-8878-656feb0c1a87/
Parent samples :
bc9379090bc8de95b1f765cd41ddd45043e2fdceb86ed2dd0e4d988600baae85
5c17631af38e9a8910015e2ca160a7d9505c9ca8863be9258b3e30411301a03f
b24c3ed00e59dbcff18037648cad503072b9e0d7a13f30d2bbfa9c466fdbee66
SH256 hash:
bc9379090bc8de95b1f765cd41ddd45043e2fdceb86ed2dd0e4d988600baae85
MD5 hash:
8b22323e8a0b8bf647766c2343edc45b
SHA1 hash:
8843599ba312e4842ca139157fe48aed18d7696b
Link:
https://www.unpac.me/results/5ba8517f-a766-4299-8878-656feb0c1a87/
Malware family:
Dridex
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/bc9379090bc8/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/bc9379090bc8de95b1f765cd41ddd45043e2fdceb86ed2dd0e4d988600baae85

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Dridex

DLL dll bc9379090bc8de95b1f765cd41ddd45043e2fdceb86ed2dd0e4d988600baae85

(this sample)

  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/1881530/
Cape
Cape
https://www.capesandbox.com/analysis/213671/

Comments


Avatar
zbet commented on 2021-12-13 19:13:12 UTC

url : hxxps://caioaraujo.vip/CXUUV/ardAbnbIhodickpenis.bin