MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 caaac89a744e94aa0735d858e6d30445a5f92e7fe4c9bdbcd1a1bd92e626fcc7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Dridex

Vendor detections: 10

Intelligence 10 IOCs YARA 2 File information Comments

SHA256 hash:	caaac89a744e94aa0735d858e6d30445a5f92e7fe4c9bdbcd1a1bd92e626fcc7
SHA3-384 hash:	a6ab2cd789414aa5878ebbc5cb0234c6c37888aa767653bac39b80388024d748340d3e94a1e8c134f04a784360a69d41
SHA1 hash:	cba2626c515d8cc4bf77e9de64cbd7451691e6b6
MD5 hash:	66247c25d2ca7dedffe2fd183e5a13f7
humanhash:	early-single-carolina-one
File name:	uUQBEEniggerjewhitler.mp4
Download:	download sample
Signature	Dridex Create hunting rule
File size:	668'520 bytes
First seen:	2021-11-22 14:59:55 UTC
Last seen:	Never
File type:	dll
MIME type:	application/x-dosexec
imphash	b7c97a32f8446f2667c75327c69c37cd (3 x Dridex)
ssdeep	6144:f+HG2WUYYUeWUkWk+WUCWUmWUOWUwWUA4UUWqqWUGWU8YUCWC4WUiWUrHw9GlzgB:VOHwszfO5snBpZf4w0CA7
Threatray	5'420 similar samples on MalwareBazaar
TLSH	T1F5E4B01E7188C05BC5CAACB974B37B646585943C2DE9A4F7F06336A8D74B2B8BC17078
Reporter	Cryptolaemus1
Tags:	22203 dll Dridex signed STAND ALONE MUSIC LTD

Code Signing Certificate

Organisation:	STAND ALONE MUSIC LTD
Issuer:	Sectigo RSA Code Signing CA
Algorithm:	sha256WithRSAEncryption
Valid from:	2020-12-07T00:00:00Z
Valid to:	2021-12-07T23:59:59Z
Serial number:	3b777165b125bccc181d0bac3f5b55b3
Intelligence:	55 malware samples on MalwareBazaar are signed with this code signing certificate
MalwareBazaar Blocklist:	This certificate is on the MalwareBazaar code signing certificate blocklist (CSCB)
Thumbprint Algorithm:	SHA256
Thumbprint:	f680fab6a9d21e8e76003c5c28b3c5084866d7ac85cf0cfb5aaa02f69ee99f1e
Source:	This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin

# of uploads :

# of downloads :

133

Origin country :

n/a

Vendor Threat Intelligence

Gathering data

Result

Verdict:

Malware

Maliciousness:

Behaviour

Searching for the window

Сreating synchronization primitives

DNS request

Verdict:

Suspicious

Threat level:

5/10

Confidence:

67%

Tags:

overlay packed

Link:

https://www.filescan.io/uploads/619bb07894a88037d2fe8c8a/reports/62dd357b-9daf-4fa8-87c0-92fead3923ca/overview

Malware family:

Dridex

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/695dc1b0-614f-4ed2-a8e2-df7ec26bceb8

Result

Threat name:

Dridex

Detection:

malicious

Classification:

troj

Score:

68 / 100

Link:

https://www.joesandbox.com/analysis/893951

Signature

C2 URLs / IPs found in malware configuration

Found malware configuration

Multi AV Scanner detection for submitted file

Yara detected Dridex unpacked file

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/caaac89a744e94aa0735d858e6d30445a5f92e7fe4c9bdbcd1a1bd92e626fcc7/

Threat name:

Win32.Trojan.Drixed

Status:

Malicious

First seen:

2021-11-17 23:22:24 UTC

File Type:

PE (Dll)

AV detection:

30 of 45 (66.67%)

Threat level:

5/5

Verdict:

malicious

Label(s):

doppeldridex

dridex

Dridex

6f2cb590bad8c42912576399c30686ffe95d28aee7adc9d0507335bb3d7e5824

Dridex

7abfd89f20fc6b4d28c95fd22a977fbc247438071fdb6710fe24487d571c3314

Dridex

87ec152bfeda4a61988a9ade1dd1f45e2f39e7030b584be83de9da95d53a299e

Dridex

c06e84c106ca78b1189aa03a7269ea76efd7879e3ef28a78ef9dcd5303328411

Dridex

d45df1bb669ebf3995005dd8e0c4a6999a776501cbca500182024b763b71cc1e

Dridex

dd8ac82effcb27eda36f0792d7ff5d50c66bca2c20386c5dd25565970f8234c2

Dridex

dee4e7db5288498de87f415981fbaec17e88dc9fdef3dbcc5aac39395aafe5ea

Dridex

+ 5'410 additional samples on MalwareBazaar

Result

Malware family:

dridex

Score:

10/10

Tags:

family:dridex botnet:22203 botnet loader

Link:

https://tria.ge/reports/211122-sdblmafgfl/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Program crash

Dridex Loader

Dridex

Malware Config

C2 Extraction:

54.37.70.105:443
198.199.70.22:6602
164.68.99.3:5007
142.93.218.86:4664

Unpacked files

SH256 hash:

67ef5a4eae647c84bbf565127189d693aea067ac3c4263ace6804f8621afd086

MD5 hash:

f59d5559c9766bf2790c5705fe31342f

SHA1 hash:

f08f79ba565702b6987d2b50448eac449f9ebe12

Detections:

win_dridex_auto

Link:

https://www.unpac.me/results/a0fe8735-e656-4487-b2f1-404c29ef33e8/

Parent samples :

dee4e7db5288498de87f415981fbaec17e88dc9fdef3dbcc5aac39395aafe5ea
32d586a56d67479bfb6a97af3946d36eef30763c090fe183ea859235b2b41be2
caaac89a744e94aa0735d858e6d30445a5f92e7fe4c9bdbcd1a1bd92e626fcc7

SH256 hash:

8b884d14cda93398c6feb00ae53b43ce15662cf1976ab1f813fd317adfce69ae

MD5 hash:

258043982abc8c8e011f170cf1184573

SHA1 hash:

ab34e6106d7d25682b2add9625bce85d7d10db20

Detections:

win_doppeldridex_auto

Link:

https://www.unpac.me/results/a0fe8735-e656-4487-b2f1-404c29ef33e8/

SH256 hash:

caaac89a744e94aa0735d858e6d30445a5f92e7fe4c9bdbcd1a1bd92e626fcc7

MD5 hash:

66247c25d2ca7dedffe2fd183e5a13f7

SHA1 hash:

cba2626c515d8cc4bf77e9de64cbd7451691e6b6

Link:

https://www.unpac.me/results/a0fe8735-e656-4487-b2f1-404c29ef33e8/

Malware family:

Dridex

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/caaac89a744e/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/caaac89a744e94aa0735d858e6d30445a5f92e7fe4c9bdbcd1a1bd92e626fcc7

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Sectigo_Code_Signed Create hunting rule
Description:	Detects code signed by the Sectigo RSA Code Signing CA
Reference:	https://bazaar.abuse.ch/export/csv/cscb/

Rule name:	Sectigo_Code_Signed Create hunting rule
Description:	Detects code signed by the Sectigo RSA Code Signing CA
Reference:	https://bazaar.abuse.ch/export/csv/cscb/