🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 be3eb491dd9953d6d06879a99357613f2a837f8a79a2ac3b67dfe7e6ce2bfdec. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Dridex


Vendor detections: 8


Intelligence 8 IOCs YARA File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: be3eb491dd9953d6d06879a99357613f2a837f8a79a2ac3b67dfe7e6ce2bfdec
SHA3-384 hash: 8815fe77b5e41951eff0a8bb6a3db740f2a8a7b2e60cf30fd946468bc0104e808f1e8a73f64247b2455bbe125af3d254
SHA1 hash: 062249b1a47ba13363f99b00d667dde77ef68d03
MD5 hash: b04446e8c3b7ff393c5d5d75248d8b8a
humanhash: indigo-west-bacon-fourteen
File name:b04446e8c3b7ff393c5d5d75248d8b8a
Download: download sample
Signature Dridex
Create hunting rule
File size:663'552 bytes
First seen:2021-11-18 03:54:53 UTC
Last seen:2021-11-18 06:03:16 UTC
File type:DLL dll
MIME type:application/x-dosexec
imphash fe16443ce39f2fcea9c5accdb27a9eac (21 x Dridex)
ssdeep 12288:HjTlJzJzJBJZn/JH3lJxJLJZJdPgA1VKBUA1rlldNJw:HjJtpDv/lVbdT3IA1wBUA1rlldNK
Threatray 5'366 similar samples on MalwareBazaar
TLSH T1DDE48E0250D512FCFA898ABF155A67C1C6B310824ED1CB9E25CD07EADF64A03EE6D1B7
Reporter zbetcheckin
Tags:32 dll Dridex exe

Intelligence

File Origin
# of uploads :
3
# of downloads :
131
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/207084/
Detection(s):
SecuriteInfo.com.Variant.Lazy.17111.19242.19901.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Сreating synchronization primitives
DNS request
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/6195ce9c43e8f62b6698163a/reports/3d5fc5f6-c9a8-4e2b-b5dd-dafd0d1c743e/overview
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/9ac638ee-3ee4-489f-9b8b-d75e8ee80afb
Result
Threat name:
Dridex
Create hunting rule
Detection:
malicious
Classification:
troj
Score:
72 / 100
Link:
https://www.joesandbox.com/analysis/891681
Signature
C2 URLs / IPs found in malware configuration
Found malware configuration
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Yara detected Dridex unpacked file
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 524154 Sample: J9GMTO4Amo Startdate: 18/11/2021 Architecture: WINDOWS Score: 72 17 54.37.70.105 OVHFR France 2->17 19 142.93.218.86 DIGITALOCEAN-ASNUS United States 2->19 21 2 other IPs or domains 2->21 23 Found malware configuration 2->23 25 Multi AV Scanner detection for submitted file 2->25 27 Yara detected Dridex unpacked file 2->27 29 2 other signatures 2->29 9 loaddll32.exe 1 2->9         started        signatures3 process4 process5 11 cmd.exe 1 9->11         started        process6 13 rundll32.exe 11->13         started        process7 15 WerFault.exe 23 9 13->15         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/be3eb491dd9953d6d06879a99357613f2a837f8a79a2ac3b67dfe7e6ce2bfdec/
Threat name:
Win32.Trojan.Drixed
Create hunting rule
Status:
Malicious
First seen:
2021-11-18 03:55:07 UTC
AV detection:
18 of 45 (40.00%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
doppeldridex
Create hunting rule
dridex
Create hunting rule
Similar samples:
233abb27be4c337cf8b9999c58b73e5890a61741c896e3afe8794b13d5652eb5
Dridex
2bf87021745923bb669cc6eda22bb54b5249f74f7e7e8a04ebc4f16b01a0a8c4
Dridex
2c74a51c3843ccb411702e116ee7bf7c9efa3d53cbaf3709e789a6305a8ac67f
Dridex
32f0692da6367489eafc71602a1b075e177621e366101241206958a68318cf64
Dridex
33df285d24bac325fa5c56a08462a3ebf34904e4489abe7e6854f3f993ac033f
Dridex
832cd5a0d475e0309f03bd6a00ae888e0be1c6a8585f9175e0dbe41d3fc960a6
Dridex
8536dd733f30a414cb8040e2d15631e1124942b150c75a2ef9178e61d2a75689
Dridex
85dd0bbdc1dde143ffd3906d04ce15fa415b0f66abfaeb1f3476007c5664438e
Dridex
a3abf81a46e3e318450f496e08d8cd0c9952f43deb4c481e19f9cfd36e884f2a
Dridex
f81dcc275ffa54a53ed99e79aac49e274b1ce833b5c0c2fcfcb80a33da6e0408
Dridex
+ 5'356 additional samples on MalwareBazaar
Result
Malware family:
dridex
Create hunting rule
Score:
  10/10
Tags:
family:dridex botnet:22203 botnet loader
Link:
https://tria.ge/reports/211118-egs37abfcl/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Dridex Loader
Dridex
Malware Config
C2 Extraction:
54.37.70.105:443
198.199.70.22:6602
164.68.99.3:5007
142.93.218.86:4664
Unpacked files
SH256 hash:
f2090441a3bb393952769954320b43e892f8f98fc22c5dd78b7ed5807e53a214
MD5 hash:
2d4aaa2262517e505f52b13858dbde52
SHA1 hash:
72523dbd72452c8dacaa070f05c9145741571301
Detections:
win_doppeldridex_auto
Create hunting rule
Link:
https://www.unpac.me/results/fcba0307-ba76-417f-bb19-327738e20ae3/
Parent samples :
be3eb491dd9953d6d06879a99357613f2a837f8a79a2ac3b67dfe7e6ce2bfdec
d45df1bb669ebf3995005dd8e0c4a6999a776501cbca500182024b763b71cc1e
SH256 hash:
2e4da7dbe3d43e07cf011302db7302f7b8d632d6823966ee620ae30cf34662e7
MD5 hash:
fffeb707e430160c6d8914689e04389b
SHA1 hash:
5537b9332c0efbfae10f9b433bb851959bd11cc7
Detections:
win_dridex_auto
Create hunting rule
Link:
https://www.unpac.me/results/fcba0307-ba76-417f-bb19-327738e20ae3/
Parent samples :
8536dd733f30a414cb8040e2d15631e1124942b150c75a2ef9178e61d2a75689
32f0692da6367489eafc71602a1b075e177621e366101241206958a68318cf64
33df285d24bac325fa5c56a08462a3ebf34904e4489abe7e6854f3f993ac033f
a3abf81a46e3e318450f496e08d8cd0c9952f43deb4c481e19f9cfd36e884f2a
2bf87021745923bb669cc6eda22bb54b5249f74f7e7e8a04ebc4f16b01a0a8c4
85dd0bbdc1dde143ffd3906d04ce15fa415b0f66abfaeb1f3476007c5664438e
832cd5a0d475e0309f03bd6a00ae888e0be1c6a8585f9175e0dbe41d3fc960a6
233abb27be4c337cf8b9999c58b73e5890a61741c896e3afe8794b13d5652eb5
2c74a51c3843ccb411702e116ee7bf7c9efa3d53cbaf3709e789a6305a8ac67f
f81dcc275ffa54a53ed99e79aac49e274b1ce833b5c0c2fcfcb80a33da6e0408
b856b7bf0644dedaadccdc0c6b6c17edffb8d82abfac2db29e6107ecb8ae2912
be3eb491dd9953d6d06879a99357613f2a837f8a79a2ac3b67dfe7e6ce2bfdec
ad0a37a84fe23aa26337b1519c1208f5b2ada3d0ce4e0a6cbcceedf84f1222dc
d45df1bb669ebf3995005dd8e0c4a6999a776501cbca500182024b763b71cc1e
87ec152bfeda4a61988a9ade1dd1f45e2f39e7030b584be83de9da95d53a299e
6f2cb590bad8c42912576399c30686ffe95d28aee7adc9d0507335bb3d7e5824
dd8ac82effcb27eda36f0792d7ff5d50c66bca2c20386c5dd25565970f8234c2
c06e84c106ca78b1189aa03a7269ea76efd7879e3ef28a78ef9dcd5303328411
f1668c85b555e2c76538cbdd30418ccb6b29dc070456eee6bbfb14c55ba2244c
289bbd7c84e632bd35795623e60e1aea165eb25ebd20a6d979b7f01cf43eb0fd
7abfd89f20fc6b4d28c95fd22a977fbc247438071fdb6710fe24487d571c3314
SH256 hash:
be3eb491dd9953d6d06879a99357613f2a837f8a79a2ac3b67dfe7e6ce2bfdec
MD5 hash:
b04446e8c3b7ff393c5d5d75248d8b8a
SHA1 hash:
062249b1a47ba13363f99b00d667dde77ef68d03
Link:
https://www.unpac.me/results/fcba0307-ba76-417f-bb19-327738e20ae3/
Malware family:
Dridex
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/be3eb491dd99/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.14
Link:
https://yomi.yoroi.company/submissions/be3eb491dd9953d6d06879a99357613f2a837f8a79a2ac3b67dfe7e6ce2bfdec

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Dridex

DLL dll be3eb491dd9953d6d06879a99357613f2a837f8a79a2ac3b67dfe7e6ce2bfdec

(this sample)

  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/207084/
  
URLhaus
https://urlhaus.abuse.ch/url/1798927/

Comments


Avatar
zbet commented on 2021-11-18 03:54:55 UTC

url : hxxps://fmbrsa.am.files.1drv.com/y4maex-Uyqd9oStQeDPhrf4hWMEQrzzWE_2nhUzsTS_WynGmNGnqEemW1vjWncETQBNO9cpVGD7dtXKejqUZVJpqhK9mZeakZPuS9O5sZgMuGK1Hf0U1MlUXyQfMtzBatq-iBzJ6jSfpemwJ-C2biGeDZ1yNdrWH39UIW3tlaJAMfmvw4xG_9DBroRBWm2aSt3SyQy6k1_ESD1MQs5AVUbYVQ/fphcamwogqi.mp4