🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c4ee2acc6b5aca21235917972c19d30c5585662b59decc6994c54d51bf5d5b80. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Dridex


Vendor detections: 12


Intelligence 12 IOCs YARA 6 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c4ee2acc6b5aca21235917972c19d30c5585662b59decc6994c54d51bf5d5b80
SHA3-384 hash: 55178c23c666218af72c7611b47b9733d84ed776171664496cb250c97b2bfa6044b877d7b78cea1839fb876e09120a3d
SHA1 hash: 0327e01ea4a9f08122cd69b49fbf4af020daf296
MD5 hash: 143edeeb17658ee7a0bd3d20bc3bfeca
humanhash: black-bacon-salami-lactose
File name:triage_dropped_file
Download: download sample
Signature Dridex
Create hunting rule
File size:475'136 bytes
First seen:2021-12-20 17:41:43 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash 57e65766f4a0581548c2c413ad4e5d0d (1 x Dridex)
ssdeep 12288:uTmVEfOTituqj2N1kdoScUDxJMTfZMTfJiT1JMTnJWTnJMv9JMTDJKTVJMT:6mVEfOTituC21k/
Threatray 5'723 similar samples on MalwareBazaar
TLSH T111A4AFB5621FE427F3C02EF4CAFE59B42388A67059D23DBC40D5FAE79512CEA9087446
Reporter malwarelabnet
Tags:22202 dll Dridex

Intelligence

File Origin
# of uploads :
1
# of downloads :
247
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Packed.Generic-9916977-0
Create hunting rule

Win.Malware.Generic-9916987-0
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Searching for the window
DNS request
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
dridex packed
Link:
https://www.filescan.io/uploads/61c0c06eec6c6c14a9e5860a/reports/7cb41b7d-cbc4-43cd-a0fd-4a588bd5fbd3/overview
Malware family:
Dridex
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/0c3c2d6d-5ee9-4d23-9041-71e69f916a9b
Result
Threat name:
Dridex
Create hunting rule
Detection:
malicious
Classification:
troj
Score:
76 / 100
Link:
https://www.joesandbox.com/analysis/910511
Signature
C2 URLs / IPs found in malware configuration
Found malware configuration
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Sigma detected: Suspicious Call by Ordinal
Yara detected Dridex unpacked file
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 542995 Sample: triage_dropped_file Startdate: 20/12/2021 Architecture: WINDOWS Score: 76 18 93.104.209.107 MNET-ASGermanyDE Germany 2->18 20 144.91.122.100 CONTABODE Germany 2->20 22 2 other IPs or domains 2->22 26 Found malware configuration 2->26 28 Multi AV Scanner detection for submitted file 2->28 30 Yara detected Dridex unpacked file 2->30 32 3 other signatures 2->32 9 loaddll32.exe 1 2->9         started        signatures3 process4 process5 11 cmd.exe 1 9->11         started        process6 13 rundll32.exe 11->13         started        process7 15 WerFault.exe 23 9 13->15         started        dnsIp8 24 192.168.2.1 unknown unknown 15->24
Detection:
dridex
Create hunting rule
Link:
https://mwdb.cert.pl/sample/c4ee2acc6b5aca21235917972c19d30c5585662b59decc6994c54d51bf5d5b80/
Threat name:
Win32.Infostealer.Dridex
Create hunting rule
Status:
Malicious
First seen:
2021-12-20 17:42:10 UTC
File Type:
PE (Dll)
AV detection:
22 of 28 (78.57%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ytxcvtdlllfcci2zc6lsygotbrkykzrllhpmy2muyvgvdp25loaa._file
Verdict:
malicious
Label(s):
doppeldridex
Create hunting rule
dridex
Create hunting rule
Similar samples:
42a44e52c0b4d3105ce3f46b7ce7bd30eb24c9b320823e1c25d7ca37f1cf32f8
Dridex
492fe6caf5e12dcb484f636079c246fbf0ab4b8ed59e8e5a61131dbd1fd4d2be
Dridex
6477f31e018582791a793ff0c0273f9f2b43139c0b25a88772cb90a72111f6bb
Dridex
ce02033f92d2acef752f129963acc1e34a00521ad120258685cc52f98b3a603e
Dridex
f2dd8226773272f9aa72fe62608175c2b46edb5d7b151e39d51bc6fe3512f50a
Dridex
+ 5'713 additional samples on MalwareBazaar
Result
Malware family:
dridex
Create hunting rule
Score:
  10/10
Tags:
family:dridex botnet:22202 botnet loader
Link:
https://tria.ge/reports/211220-v91azabdc4/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Dridex Loader
Dridex
Malware Config
C2 Extraction:
144.91.122.100:443
188.214.241.242:4664
93.104.209.107:8116
5.189.190.214:593
Unpacked files
SH256 hash:
1d0d0e15a013508813e8f48376c78f43c79daab1a5585b31f828e7ddf15be4a1
MD5 hash:
889bbafc72d0f8eac5dcdcc1f1f746de
SHA1 hash:
0055f40dcc3a35fb21ee9cf6f6322dfe6866ff50
Detections:
win_dridex_auto
Create hunting rule
Link:
https://www.unpac.me/results/9f4b75c2-3ade-4b79-bda0-9c3883afc8d1/
SH256 hash:
a6d2f1697e1091f6f7a83a79614db5dc358e38168a3d31edb97f5fde3cd92d6a
MD5 hash:
ee498962e2c458494cbae1f0025e7e31
SHA1 hash:
abdf1a08593c3e6e7faac7d0ff85789cd257bb23
Detections:
win_doppeldridex_auto
Create hunting rule
Link:
https://www.unpac.me/results/9f4b75c2-3ade-4b79-bda0-9c3883afc8d1/
SH256 hash:
c4ee2acc6b5aca21235917972c19d30c5585662b59decc6994c54d51bf5d5b80
MD5 hash:
143edeeb17658ee7a0bd3d20bc3bfeca
SHA1 hash:
0327e01ea4a9f08122cd69b49fbf4af020daf296
Link:
https://www.unpac.me/results/9f4b75c2-3ade-4b79-bda0-9c3883afc8d1/
Malware family:
Dridex
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/c4ee2acc6b5a/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.96
Link:
https://yomi.yoroi.company/submissions/c4ee2acc6b5aca21235917972c19d30c5585662b59decc6994c54d51bf5d5b80

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DridexLoader
Create hunting rule
Author:kevoreilly
Description:Dridex v4 dropper C2 parsing function
Rule name:DridexV4
Create hunting rule
Author:kevoreilly
Description:Dridex v4 Payload
Rule name:dridex_loader
Create hunting rule
Author:kevoreilly
Description:Dridex Loader
Rule name:MALWARE_Win_DLLLoader
Create hunting rule
Author:ditekSHen
Description:Detects unknown DLL Loader
Rule name:win_doppeldridex_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.doppeldridex.
Rule name:win_dridex_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.dridex.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Dridex

DLL dll c4ee2acc6b5aca21235917972c19d30c5585662b59decc6994c54d51bf5d5b80

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1902686/
  
Delivery method
Distributed via web download

Comments