🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c212d2f1dfa7a4a33c145ab500894eb13ecde04016b8040b3d481a8a6b4298f4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Dridex


Vendor detections: 11


Intelligence 11 IOCs YARA 2 File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c212d2f1dfa7a4a33c145ab500894eb13ecde04016b8040b3d481a8a6b4298f4
SHA3-384 hash: 4ffdf61d3578f270e34d3048ea56d905206d2eb46139d0959953b17d8e1679c493201f945256bd8f0e3d3f54391be711
SHA1 hash: 260c2b82f6586d5bff1ca813fe883f86d7413186
MD5 hash: 08eaa5b865e64db4b0ade4bb9b21d5d5
humanhash: mirror-pluto-west-nuts
File name:08eaa5b865e64db4b0ade4bb9b21d5d5
Download: download sample
Signature Dridex
Create hunting rule
File size:768'000 bytes
First seen:2021-10-27 14:57:51 UTC
Last seen:2021-10-27 17:14:46 UTC
File type:DLL dll
MIME type:application/x-dosexec
imphash 25cb031fe02365eafb637dd0a2254650 (34 x Dridex)
ssdeep 12288:ehB6OmN5lx6S3P8UUY9eHTYtI6jd/Tvyis6SX3hwxwXcKjNE3l7w31TwMGj8/fc:e0LUY9eziI6NT6JtXxwGNCl831TCY/f
Threatray 934 similar samples on MalwareBazaar
TLSH T16DF4CF1336EAC079D072157841A0B5E05DCDBE61642E9EEBA390323E863ACD2797D71F
Reporter zbetcheckin
Tags:32 dll Dridex exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
98
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/200581/
Detection(s):
SecuriteInfo.com.UDS.Trojan-Banker.Win32.Cridex.7149.5993.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
greyware
Link:
https://www.filescan.io/uploads/617968fd9a5a1e91c5d76cac/reports/b6d7f3a3-a7fc-4815-b954-81079af933c4/overview
Malware family:
Dridex
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/0049f7e7-1887-4135-8c37-e1e108b2cb38
Result
Threat name:
Dridex
Create hunting rule
Detection:
malicious
Classification:
bank.troj.evad
Score:
88 / 100
Link:
https://www.joesandbox.com/analysis/877852
Signature
C2 URLs / IPs found in malware configuration
Detected Dridex e-Banking trojan
Found malware configuration
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
System process connects to network (likely due to code injection or exploit)
Yara detected Dridex unpacked file
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 510291 Sample: 0A1OwT2aVQ Startdate: 27/10/2021 Architecture: WINDOWS Score: 88 28 Found malware configuration 2->28 30 Multi AV Scanner detection for submitted file 2->30 32 Yara detected Dridex unpacked file 2->32 34 2 other signatures 2->34 7 loaddll32.exe 13 2->7         started        process3 signatures4 38 Detected Dridex e-Banking trojan 7->38 10 cmd.exe 1 7->10         started        12 rundll32.exe 7->12         started        14 rundll32.exe 7->14         started        16 rundll32.exe 7->16         started        process5 process6 18 rundll32.exe 12 10->18         started        dnsIp7 22 185.56.219.47, 49763, 49769, 49773 KELIWEBIT Italy 18->22 24 192.46.210.220, 443, 49749, 49752 FRAUNHOFER-CLUSTER-BWResearchInstitutesspreadalloverGe United States 18->24 26 2 other IPs or domains 18->26 36 System process connects to network (likely due to code injection or exploit) 18->36 signatures8
Detection:
dridex
Create hunting rule
Link:
https://mwdb.cert.pl/sample/c212d2f1dfa7a4a33c145ab500894eb13ecde04016b8040b3d481a8a6b4298f4/
Threat name:
Win32.Infostealer.Dridex
Create hunting rule
Status:
Malicious
First seen:
2021-10-27 14:58:10 UTC
AV detection:
12 of 28 (42.86%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=yijnf4o7u6skgpaulk2qbckowe7m3ycac24aicz5janiu22ctd2a._file
Verdict:
malicious
Label(s):
dridex
Create hunting rule
gozi
Create hunting rule
Similar samples:
05807cb4a338d25da2da063ed242f25d9747d5eaa77bfc8db5b027a710ffffed
Dridex
240c19f0393b3c0bc6353b5feb1ba39d78aed4102931e4d6cf01bc8ee7979c12
Dridex
24921383732b0349bb1d0fc8c3d0e881b37229254f07f21ee2eab2b06e190f33
Dridex
2ec8b3b5d5d94269fd4db4f1569f6d853f9e1c4543450b40acda09e0a273d666
Dridex
6bdb0fc4446a7c18204baf4225df824e679381d10b5bfc2b95b341d8539b388e
Dridex
a728c51b40b9aa217a0e6b7d27d389325bbe2ff7a275c2a764a2a651d2c7c940
Dridex
b7c20bde2fac641759c56bc29557e38f42399c2806778072ffcf0a550fa7e49d
Dridex
c721d124999fe9388e49688994b3316a0b7c4735f96012a5efa20e1aabf87188
Dridex
f1ad281c4e5fb172b2a7f7e7346871bac05665e6a9570745d80b2e43e47da1cb
Dridex
fab5fce8f2f594e2570831bc801ea223169e432c4159312f6546721d8eac6fb5
Dridex
+ 924 additional samples on MalwareBazaar
Result
Malware family:
dridex
Create hunting rule
Score:
  10/10
Tags:
family:dridex botnet:10555 botnet discovery evasion trojan
Link:
https://tria.ge/reports/211027-sb6c8afcb9/
Behaviour
Suspicious use of WriteProcessMemory
Checks installed software on the system
Checks whether UAC is enabled
Blocklisted process makes network request
Dridex
Malware Config
C2 Extraction:
192.46.210.220:443
143.244.140.214:808
45.77.0.96:6891
185.56.219.47:8116
Unpacked files
SH256 hash:
e80b7a50a2d9a3201245b07e5c04c8f0a738bcb92e08e831d5ab83c160f4a5e1
MD5 hash:
e0ed069158b2219402ecabed277618a5
SHA1 hash:
37da1f48dbdc7ff80ba14e2be914173621c3e264
Link:
https://www.unpac.me/results/89816d94-cfa1-49cc-8d43-e0a594b64645/
SH256 hash:
c212d2f1dfa7a4a33c145ab500894eb13ecde04016b8040b3d481a8a6b4298f4
MD5 hash:
08eaa5b865e64db4b0ade4bb9b21d5d5
SHA1 hash:
260c2b82f6586d5bff1ca813fe883f86d7413186
Link:
https://www.unpac.me/results/89816d94-cfa1-49cc-8d43-e0a594b64645/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/c212d2f1dfa7a4a33c145ab500894eb13ecde04016b8040b3d481a8a6b4298f4

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DridexLoader
Create hunting rule
Author:kevoreilly
Description:Dridex v4 dropper C2 parsing function
Rule name:win_dridex_loader_v2
Create hunting rule
Author:Johannes Bader @viql
Description:detects some Dridex loaders

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Dridex

DLL dll c212d2f1dfa7a4a33c145ab500894eb13ecde04016b8040b3d481a8a6b4298f4

(this sample)

  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/1719739/
Cape
Cape
https://www.capesandbox.com/analysis/200581/

Comments


Avatar
zbet commented on 2021-10-27 14:57:52 UTC

url : hxxps://qrmenu.ionoxwebstudio.com/j24ihlf.tar