🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d45df1bb669ebf3995005dd8e0c4a6999a776501cbca500182024b763b71cc1e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Dridex


Vendor detections: 10


Intelligence 10 IOCs YARA File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d45df1bb669ebf3995005dd8e0c4a6999a776501cbca500182024b763b71cc1e
SHA3-384 hash: ca7299bcd7edea8e42fb4bd95dd8338e5ec964410b1c93f78a9578ad7863ba91dc8259a4f0b3179a931e2c57b4e88172
SHA1 hash: f1b1a00fc8651458d7c7b58c2408f0886d04c9de
MD5 hash: 5845c2aa5c8798f7078bd96da06b1051
humanhash: rugby-asparagus-tango-charlie
File name:5845c2aa5c8798f7078bd96da06b1051
Download: download sample
Signature Dridex
Create hunting rule
File size:663'552 bytes
First seen:2021-11-18 15:20:47 UTC
Last seen:2021-11-18 18:14:08 UTC
File type:DLL dll
MIME type:application/x-dosexec
imphash fe16443ce39f2fcea9c5accdb27a9eac (21 x Dridex)
ssdeep 12288:77TlJzJzJBJZn/JH3lJxJLJZJdPgA1VKBUA1rlldQJw:77JtpDv/lVbdT3IA1wBUA1rlldQK
Threatray 5'371 similar samples on MalwareBazaar
TLSH T19AE48E0250D512FCFA898ABF155A67C1C6B310824ED1CB9E25CD07EADF64A03EE6D1B7
Reporter zbetcheckin
Tags:32 dll Dridex exe

Intelligence

File Origin
# of uploads :
3
# of downloads :
136
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Detection(s):
SecuriteInfo.com.Variant.Lazy.17111.936.14350.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Searching for the window
Сreating synchronization primitives
DNS request
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
67%
Tags:
dridex packed
Link:
https://www.filescan.io/uploads/61966f604912a8c920a2b213/reports/bd45a93a-7fd4-494c-854a-5b832152569d/overview
Malware family:
Dridex
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/f5ea020e-4188-4c82-8e0e-e9e9df6bbb7c
Result
Threat name:
Dridex
Create hunting rule
Detection:
malicious
Classification:
troj
Score:
72 / 100
Link:
https://www.joesandbox.com/analysis/892052
Signature
C2 URLs / IPs found in malware configuration
Found malware configuration
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Yara detected Dridex unpacked file
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 524525 Sample: 8502ygJBxf Startdate: 18/11/2021 Architecture: WINDOWS Score: 72 17 54.37.70.105 OVHFR France 2->17 19 142.93.218.86 DIGITALOCEAN-ASNUS United States 2->19 21 2 other IPs or domains 2->21 23 Found malware configuration 2->23 25 Multi AV Scanner detection for submitted file 2->25 27 Yara detected Dridex unpacked file 2->27 29 2 other signatures 2->29 9 loaddll32.exe 1 2->9         started        signatures3 process4 process5 11 cmd.exe 1 9->11         started        process6 13 rundll32.exe 11->13         started        process7 15 WerFault.exe 23 9 13->15         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d45df1bb669ebf3995005dd8e0c4a6999a776501cbca500182024b763b71cc1e/
Threat name:
Win32.Trojan.Drixed
Create hunting rule
Status:
Malicious
First seen:
2021-11-18 15:14:32 UTC
AV detection:
16 of 26 (61.54%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
doppeldridex
Create hunting rule
dridex
Create hunting rule
Similar samples:
233abb27be4c337cf8b9999c58b73e5890a61741c896e3afe8794b13d5652eb5
Dridex
2bf87021745923bb669cc6eda22bb54b5249f74f7e7e8a04ebc4f16b01a0a8c4
Dridex
2c74a51c3843ccb411702e116ee7bf7c9efa3d53cbaf3709e789a6305a8ac67f
Dridex
32f0692da6367489eafc71602a1b075e177621e366101241206958a68318cf64
Dridex
33df285d24bac325fa5c56a08462a3ebf34904e4489abe7e6854f3f993ac033f
Dridex
832cd5a0d475e0309f03bd6a00ae888e0be1c6a8585f9175e0dbe41d3fc960a6
Dridex
8536dd733f30a414cb8040e2d15631e1124942b150c75a2ef9178e61d2a75689
Dridex
85dd0bbdc1dde143ffd3906d04ce15fa415b0f66abfaeb1f3476007c5664438e
Dridex
a3abf81a46e3e318450f496e08d8cd0c9952f43deb4c481e19f9cfd36e884f2a
Dridex
f81dcc275ffa54a53ed99e79aac49e274b1ce833b5c0c2fcfcb80a33da6e0408
Dridex
+ 5'361 additional samples on MalwareBazaar
Result
Malware family:
dridex
Create hunting rule
Score:
  10/10
Tags:
family:dridex botnet:22203 botnet loader
Link:
https://tria.ge/reports/211118-srbtjsechn/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Dridex Loader
Dridex
Malware Config
C2 Extraction:
54.37.70.105:443
198.199.70.22:6602
164.68.99.3:5007
142.93.218.86:4664
Unpacked files
SH256 hash:
f2090441a3bb393952769954320b43e892f8f98fc22c5dd78b7ed5807e53a214
MD5 hash:
2d4aaa2262517e505f52b13858dbde52
SHA1 hash:
72523dbd72452c8dacaa070f05c9145741571301
Detections:
win_doppeldridex_auto
Create hunting rule
Link:
https://www.unpac.me/results/2f411cf2-bec6-497d-8431-0180bfc0dd31/
Parent samples :
be3eb491dd9953d6d06879a99357613f2a837f8a79a2ac3b67dfe7e6ce2bfdec
d45df1bb669ebf3995005dd8e0c4a6999a776501cbca500182024b763b71cc1e
SH256 hash:
2e4da7dbe3d43e07cf011302db7302f7b8d632d6823966ee620ae30cf34662e7
MD5 hash:
fffeb707e430160c6d8914689e04389b
SHA1 hash:
5537b9332c0efbfae10f9b433bb851959bd11cc7
Detections:
win_dridex_auto
Create hunting rule
Link:
https://www.unpac.me/results/2f411cf2-bec6-497d-8431-0180bfc0dd31/
Parent samples :
8536dd733f30a414cb8040e2d15631e1124942b150c75a2ef9178e61d2a75689
32f0692da6367489eafc71602a1b075e177621e366101241206958a68318cf64
33df285d24bac325fa5c56a08462a3ebf34904e4489abe7e6854f3f993ac033f
a3abf81a46e3e318450f496e08d8cd0c9952f43deb4c481e19f9cfd36e884f2a
2bf87021745923bb669cc6eda22bb54b5249f74f7e7e8a04ebc4f16b01a0a8c4
85dd0bbdc1dde143ffd3906d04ce15fa415b0f66abfaeb1f3476007c5664438e
832cd5a0d475e0309f03bd6a00ae888e0be1c6a8585f9175e0dbe41d3fc960a6
233abb27be4c337cf8b9999c58b73e5890a61741c896e3afe8794b13d5652eb5
2c74a51c3843ccb411702e116ee7bf7c9efa3d53cbaf3709e789a6305a8ac67f
f81dcc275ffa54a53ed99e79aac49e274b1ce833b5c0c2fcfcb80a33da6e0408
b856b7bf0644dedaadccdc0c6b6c17edffb8d82abfac2db29e6107ecb8ae2912
be3eb491dd9953d6d06879a99357613f2a837f8a79a2ac3b67dfe7e6ce2bfdec
ad0a37a84fe23aa26337b1519c1208f5b2ada3d0ce4e0a6cbcceedf84f1222dc
d45df1bb669ebf3995005dd8e0c4a6999a776501cbca500182024b763b71cc1e
87ec152bfeda4a61988a9ade1dd1f45e2f39e7030b584be83de9da95d53a299e
6f2cb590bad8c42912576399c30686ffe95d28aee7adc9d0507335bb3d7e5824
dd8ac82effcb27eda36f0792d7ff5d50c66bca2c20386c5dd25565970f8234c2
c06e84c106ca78b1189aa03a7269ea76efd7879e3ef28a78ef9dcd5303328411
f1668c85b555e2c76538cbdd30418ccb6b29dc070456eee6bbfb14c55ba2244c
289bbd7c84e632bd35795623e60e1aea165eb25ebd20a6d979b7f01cf43eb0fd
7abfd89f20fc6b4d28c95fd22a977fbc247438071fdb6710fe24487d571c3314
SH256 hash:
d45df1bb669ebf3995005dd8e0c4a6999a776501cbca500182024b763b71cc1e
MD5 hash:
5845c2aa5c8798f7078bd96da06b1051
SHA1 hash:
f1b1a00fc8651458d7c7b58c2408f0886d04c9de
Link:
https://www.unpac.me/results/2f411cf2-bec6-497d-8431-0180bfc0dd31/
Malware family:
Dridex
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/d45df1bb669e/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Trojan
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/d45df1bb669ebf3995005dd8e0c4a6999a776501cbca500182024b763b71cc1e

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Dridex

DLL dll d45df1bb669ebf3995005dd8e0c4a6999a776501cbca500182024b763b71cc1e

(this sample)

  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/1799598/
Cape
Cape
https://www.capesandbox.com/analysis/207288/

Comments


Avatar
zbet commented on 2021-11-18 15:20:48 UTC

url : hxxps://bkokja.am.files.1drv.com/y4mWRGUUnzhI35YIl3D8GAw4mWx8O_CegpfREqgyABNLGJ0I5BcPf8KL-o_v1m3vrjiZ6j-nB4aMFUwJ41VhCdsNNkLePKgLVV87NWndZ5Mvtfh7b3RvWJcWH7sKcyPbgR1o0lFaqg9vbWSxgqxBFCJxed-K1XeJvMWrThrph-2nAhiBR2TZn0iJiodvV44avA3WXNz5IFDZph_uzgK80oXaQ/udtptnmcfrz.mp4