🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d34dd26ccc1bfecc424566f0262e855d61581078dc342aa84038c02e8f2bd751. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Dridex


Vendor detections: 10


Intelligence 10 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d34dd26ccc1bfecc424566f0262e855d61581078dc342aa84038c02e8f2bd751
SHA3-384 hash: 517fc06311c1ac9a59df71c50e92e44af71bc70e760d813c90fefd55210ed830b57baf7f2cb9c3993b4f8d50a6a9fbd4
SHA1 hash: 1f915582dd8f93b95e6fbf3748a9f4495be7345e
MD5 hash: 0cc99a641ba40204b63b63cd03efc5df
humanhash: sierra-failed-eight-purple
File name:triage_dropped_file
Download: download sample
Signature Dridex
Create hunting rule
File size:192'512 bytes
First seen:2021-08-16 21:17:54 UTC
Last seen:2021-08-16 21:53:31 UTC
File type:DLL dll
MIME type:application/x-dosexec
imphash 86bd8478222b7f02b724c9321381bb0a (2 x Dridex)
ssdeep 3072:YWa3N1eqJ7cNe58per6JpynepWHVD9qMe402JYIUk9H8Iz83SWZ9klSC:IxwO/Spynep6VDcMeQeIUk9cI6h5
Threatray 4'901 similar samples on MalwareBazaar
TLSH T1B214D083EBFB72BBD0024CB22729963B6559D846CE58DDD5F592D216C073EC2502BE23
Reporter malwarelabnet
Tags:dll Dridex

Intelligence

File Origin
# of uploads :
2
# of downloads :
177
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/179738/
Detection(s):
SecuriteInfo.com.W32.AIDetect.malware2.2257.2566.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Sending a UDP request
Malware family:
Dridex
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/08411bd4-1578-4e28-ba63-b38e498460ea
Result
Threat name:
Dridex Dropper
Create hunting rule
Detection:
malicious
Classification:
bank.troj.evad
Score:
88 / 100
Link:
https://www.joesandbox.com/analysis/833898
Signature
C2 URLs / IPs found in malware configuration
Dridex dropper found
Found malware configuration
Found PHP interpreter
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Tries to detect sandboxes / dynamic malware analysis system (file name check)
Yara detected Dridex unpacked file
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 466325 Sample: triage_dropped_file Startdate: 16/08/2021 Architecture: WINDOWS Score: 88 44 103.109.247.9 IDNIC-UNUSA-AS-IDUniversitasNahdlatulUlamaSurabayaID Indonesia 2->44 46 188.40.100.254 HETZNER-ASDE Germany 2->46 48 134.209.182.12 DIGITALOCEAN-ASNUS United States 2->48 52 Found malware configuration 2->52 54 Multi AV Scanner detection for submitted file 2->54 56 Dridex dropper found 2->56 58 4 other signatures 2->58 10 loaddll32.exe 1 2->10         started        signatures3 process4 signatures5 62 Tries to detect sandboxes / dynamic malware analysis system (file name check) 10->62 13 cmd.exe 1 10->13         started        15 rundll32.exe 10->15         started        18 rundll32.exe 10->18         started        20 5 other processes 10->20 process6 signatures7 22 rundll32.exe 13->22         started        64 Tries to detect sandboxes / dynamic malware analysis system (file name check) 15->64 25 WerFault.exe 2 9 15->25         started        27 WerFault.exe 15->27         started        29 WerFault.exe 9 18->29         started        31 WerFault.exe 18->31         started        33 WerFault.exe 20->33         started        35 WerFault.exe 20->35         started        37 WerFault.exe 20->37         started        process8 signatures9 60 Tries to detect sandboxes / dynamic malware analysis system (file name check) 22->60 39 WerFault.exe 23 9 22->39         started        process10 dnsIp11 50 192.168.2.1 unknown unknown 39->50 42 conhost.exe 39->42         started        process12
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d34dd26ccc1bfecc424566f0262e855d61581078dc342aa84038c02e8f2bd751/
Threat name:
Win32.Infostealer.Dridex
Create hunting rule
Status:
Malicious
First seen:
2021-08-16 21:18:13 UTC
AV detection:
13 of 27 (48.15%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=2ng5e3gmdp7myqsfm3ycmluflvqvqedy3q2cvkcahdac5dzl25iq._file
Verdict:
malicious
Label(s):
doppeldridex
Create hunting rule
dridex
Create hunting rule
Similar samples:
0a393f396f87a892009b0800573494b24bfc1f7f236ec1bc0068664be31c57fb
Dridex
0ef83c93e551f8d1f6e43a2886f24b737b8594d96a84d49af2249074d71e386e
Dridex
21e2bab61ebddbbc47292ed5ef733b56073cd8590959ebeb01c583f7180612b6
Dridex
34b37c76248658d208da1630b2d9ce36147ad34c7caa1ccd2d2abd00191beaa8
Dridex
4029e74468c92f45602e675f3f3ec1b45489ca962f36700434021ddc0e3acc26
Dridex
42da374b203106b74b9144de5efb3132bc161e5a641b85ce53fe576f8bfc6201
Dridex
59e61b5ec3eb024ce68f9011a69ccb617120fb95100835d173e44c8dc4d08924
Dridex
901782479cf975a8b2811264fd34f2e6fde694dcb968ce8bf502cb054ac9eb5a
Dridex
e5c88a3b3c7e335b83b9823248efeafcc25295a80cde517869ced7580c90a65c
Dridex
f7d5faaf527162e4638350db7a5a79287af9e2a22d3409a75497695eee6e9e5f
Dridex
+ 4'891 additional samples on MalwareBazaar
Result
Malware family:
dridex
Create hunting rule
Score:
  10/10
Tags:
family:dridex botnet:22202 botnet loader
Link:
https://tria.ge/reports/210816-p55p2k2vc6/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Dridex Loader
Dridex
Malware Config
C2 Extraction:
134.209.182.12:443
188.40.100.254:4664
103.109.247.9:10443
Unpacked files
SH256 hash:
4e40b3ce71cad57ee78ed6faf3d2f4a9fb36872ba9a46f2e4f14ede2ffa565e2
MD5 hash:
903b20d3712a779a051ee3227996c24e
SHA1 hash:
df977e0e6c8931f15c0500514adebcbe7084776c
Detections:
win_dridex_auto
Create hunting rule
Link:
https://www.unpac.me/results/6e1411d8-ddbc-46ef-a413-c69c23140187/
Parent samples :
d34dd26ccc1bfecc424566f0262e855d61581078dc342aa84038c02e8f2bd751
654055dd7123d970ab65cf73a94418b81105c73bfb9a591a24be998da4f31373
SH256 hash:
1e4c698a69d3a3ca3409d6ff4fbcb05076e52c4f654a265bc469c5eb464e55d1
MD5 hash:
75ce7f8a549a012cd1951ef11d1be554
SHA1 hash:
2d5c69d05c5baffc0e14dd633d960db5762cdac6
Detections:
win_doppeldridex_auto
Create hunting rule
Link:
https://www.unpac.me/results/6e1411d8-ddbc-46ef-a413-c69c23140187/
SH256 hash:
d34dd26ccc1bfecc424566f0262e855d61581078dc342aa84038c02e8f2bd751
MD5 hash:
0cc99a641ba40204b63b63cd03efc5df
SHA1 hash:
1f915582dd8f93b95e6fbf3748a9f4495be7345e
Link:
https://www.unpac.me/results/6e1411d8-ddbc-46ef-a413-c69c23140187/
Malware family:
Dridex
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/d34dd26ccc1b/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.56
Link:
https://yomi.yoroi.company/submissions/d34dd26ccc1bfecc424566f0262e855d61581078dc342aa84038c02e8f2bd751

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DridexLoader
Create hunting rule
Author:kevoreilly
Description:Dridex v4 dropper C2 parsing function
Rule name:DridexV4
Create hunting rule
Author:kevoreilly
Description:Dridex v4 Payload
Rule name:MALWARE_Win_DLLLoader
Create hunting rule
Author:ditekSHen
Description:Detects unknown DLL Loader
Rule name:win_doppeldridex_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.doppeldridex.
Rule name:win_dridex_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.dridex.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/179738/

Comments