🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ceec0ff35d3b1f525c0e4c6bc25e6758a59c8d3133e2f1c6089debc7985c27c8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Dridex


Vendor detections: 9


Intelligence 9 IOCs YARA File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ceec0ff35d3b1f525c0e4c6bc25e6758a59c8d3133e2f1c6089debc7985c27c8
SHA3-384 hash: 6400bc236f881faaec379f4fdbf86dca5563442ee0f02b40f2fe2464315140ccb0110a6eca077895db537e502b0d9f88
SHA1 hash: a5a64baed65ac713a717c3096a521598130a1c77
MD5 hash: 5311dcbf78d7dcac89c2557095595f4f
humanhash: william-summer-india-montana
File name:5311dcbf78d7dcac89c2557095595f4f
Download: download sample
Signature Dridex
Create hunting rule
File size:188'416 bytes
First seen:2021-08-11 15:43:42 UTC
Last seen:2021-08-11 17:06:58 UTC
File type:DLL dll
MIME type:application/x-dosexec
imphash c88b1b8168f2947a82592f1323fdc522 (3 x Dridex)
ssdeep 3072:h1JzSxp5PpRh7phfrv/6jC5KHWnzD7xC3/o1WXDCFUBUL1iMhmDEwmuFWwyF:h1JGz5pX7fz+C5kUzDA36bFUc1i7EwRu
Threatray 4'859 similar samples on MalwareBazaar
TLSH T17604E090E7CB1269E6631875152D332264A27F219670EE9ECE1DC62887774236F3E3C7
Reporter zbetcheckin
Tags:32 dll Dridex exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
390
Origin country :
n/a
Vendor Threat Intelligence
Detection:
DridexLoader
Create hunting rule
Link:
https://www.capesandbox.com/analysis/178321/
Detection(s):
SecuriteInfo.com.W32.AIDetect.malware2.17671.31366.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
DNS request
Sending a UDP request
Malware family:
Dridex
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/120c4f98-e88a-4a04-b267-55275b909d31
Result
Threat name:
Dridex Dropper
Create hunting rule
Detection:
malicious
Classification:
troj.evad.bank
Score:
92 / 100
Link:
https://www.joesandbox.com/analysis/831100
Signature
C2 URLs / IPs found in malware configuration
Dridex dropper found
Found malware configuration
Found PHP interpreter
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Tries to delay execution (extensive OutputDebugStringW loop)
Tries to detect sandboxes / dynamic malware analysis system (file name check)
Yara detected Dridex unpacked file
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 463531 Sample: eQvVRN6cjj.dll Startdate: 11/08/2021 Architecture: WINDOWS Score: 92 39 87.98.128.76 OVHFR France 2->39 41 80.241.218.90 CONTABODE Germany 2->41 43 103.161.172.109 AARNET-AS-APAustralianAcademicandResearchNetworkAARNe unknown 2->43 47 Found malware configuration 2->47 49 Multi AV Scanner detection for submitted file 2->49 51 Dridex dropper found 2->51 53 4 other signatures 2->53 9 loaddll32.exe 1 2->9         started        signatures3 process4 signatures5 55 Tries to detect sandboxes / dynamic malware analysis system (file name check) 9->55 12 rundll32.exe 9->12         started        15 rundll32.exe 9->15         started        17 cmd.exe 1 9->17         started        19 4 other processes 9->19 process6 signatures7 59 Tries to detect sandboxes / dynamic malware analysis system (file name check) 12->59 61 Tries to delay execution (extensive OutputDebugStringW loop) 12->61 21 WerFault.exe 9 15->21         started        24 WerFault.exe 2 9 15->24         started        26 rundll32.exe 17->26         started        29 WerFault.exe 9 19->29         started        31 WerFault.exe 19->31         started        33 WerFault.exe 19->33         started        35 WerFault.exe 19->35         started        process8 dnsIp9 45 192.168.2.1 unknown unknown 21->45 57 Tries to detect sandboxes / dynamic malware analysis system (file name check) 26->57 37 WerFault.exe 23 9 26->37         started        signatures10 process11
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ceec0ff35d3b1f525c0e4c6bc25e6758a59c8d3133e2f1c6089debc7985c27c8/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2021-08-11 15:44:06 UTC
AV detection:
16 of 46 (34.78%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
doppeldridex
Create hunting rule
dridex
Create hunting rule
Similar samples:
190b2cdfa53eaab02c24d69923988103a84cd2862c6c9d70a18feebbb3f0bc64
Dridex
297fa628e174f62edfc8ecf1e4ec79d8f177fe89308a0c04a0b55693af0a776f
Dridex
4029e74468c92f45602e675f3f3ec1b45489ca962f36700434021ddc0e3acc26
Dridex
59e61b5ec3eb024ce68f9011a69ccb617120fb95100835d173e44c8dc4d08924
Dridex
8f4306637d344a0673f623cf2b7326fd9b064a5b56b2e88ec3796c879274bf1c
Dridex
901782479cf975a8b2811264fd34f2e6fde694dcb968ce8bf502cb054ac9eb5a
Dridex
bb54dc0cfa4ac775461547a04c989435a95653d288ff7f4bf6cd50100d8a0d49
Dridex
e028f271461ba72f91934ada56064d0eab66b4ad3066d653632fad04351efb00
Dridex
f4f0127923c4a1c69aab04516907fd4010f9af8302e132b972d053813577b18d
Dridex
+ 4'849 additional samples on MalwareBazaar
Result
Malware family:
dridex
Create hunting rule
Score:
  10/10
Tags:
family:dridex botnet:22201 botnet loader
Link:
https://tria.ge/reports/210811-k7fkzhkv7x/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Dridex Loader
Dridex
Malware Config
C2 Extraction:
80.241.218.90:443
103.161.172.109:13786
87.98.128.76:5723
Unpacked files
SH256 hash:
cf3a070c354c281aead5882e1abba391d0c0044f6a453e11b3f845b5cf8f4988
MD5 hash:
45c90e07c15935db64bbbdd5e28589c5
SHA1 hash:
0f0ee12b2537d2ac14c73b2e9e0a6ae1bfdaa3fc
Detections:
win_dridex_auto
Create hunting rule
Link:
https://www.unpac.me/results/7b03f3db-4e40-476d-8aa1-4fa5756647b4/
Parent samples :
ceec0ff35d3b1f525c0e4c6bc25e6758a59c8d3133e2f1c6089debc7985c27c8
64fc64d39aa5da0b7b45ba083f17c4db5045e9f144ba24c2f54634a87213df92
ee9409c9e9ed5324f7a6ce9704076d1effa78c9c9de14ae7b8a7bc6edb30abd7
SH256 hash:
84415984d466585867d2a3016888080b093e31be1a3e06702e653d3e446c247e
MD5 hash:
a54a9f7c3e42714a98788b0353cda9d9
SHA1 hash:
a78b9fda3954e4e1ee15cfe43bf449c1a937bd7f
Detections:
win_doppeldridex_auto
Create hunting rule
Link:
https://www.unpac.me/results/7b03f3db-4e40-476d-8aa1-4fa5756647b4/
SH256 hash:
ceec0ff35d3b1f525c0e4c6bc25e6758a59c8d3133e2f1c6089debc7985c27c8
MD5 hash:
5311dcbf78d7dcac89c2557095595f4f
SHA1 hash:
a5a64baed65ac713a717c3096a521598130a1c77
Link:
https://www.unpac.me/results/7b03f3db-4e40-476d-8aa1-4fa5756647b4/
Malware family:
Dridex
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/ceec0ff35d3b/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.14
Link:
https://yomi.yoroi.company/submissions/ceec0ff35d3b1f525c0e4c6bc25e6758a59c8d3133e2f1c6089debc7985c27c8

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Dridex

DLL dll ceec0ff35d3b1f525c0e4c6bc25e6758a59c8d3133e2f1c6089debc7985c27c8

(this sample)

  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/178321/

Comments


Avatar
zbet commented on 2021-08-11 15:43:43 UTC

url : hxxps://ttb.pt/OLD/1old-version/beta/class/pagination/BWO90CjQ.php