🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ddcaa1c7ba38d83e0f34da7cce150905cd0246f15334b9feadd8dcab5cd991ee. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Dridex


Vendor detections: 8


Intelligence 8 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ddcaa1c7ba38d83e0f34da7cce150905cd0246f15334b9feadd8dcab5cd991ee
SHA3-384 hash: 9ab4e449fce9c38678ec70a2062ea1b527c8215b7ccbf9d0deef324eed36bf3913a934749bf880a0bd313fce29c4796e
SHA1 hash: 31a8bc5417574b89ef37c2134cc93beb87fed4ed
MD5 hash: 6aea9136fa38aeefa0a18df7264aeb61
humanhash: beryllium-florida-hamper-wisconsin
File name:SecuriteInfo.com.W32.AIDetect.malware2.19982.11373
Download: download sample
Signature Dridex
Create hunting rule
File size:438'272 bytes
First seen:2021-11-22 20:57:29 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash 8dec1a105645cd34f7153c99220eeea4 (17 x Dridex)
ssdeep 6144:HUaMQWTCJkdk5k7kBM7A9kkr+pt4PlaMEQ/j8I0r6BHAE7P4k:H+maeqIGs+N4kMEyg6uELp
Threatray 5'457 similar samples on MalwareBazaar
TLSH T140949F80F32B83E4DE09DE3B04FC985C153856E8FF5B16D5739C81FC35E49A898A6629
Reporter SecuriteInfoCom
Tags:dll Dridex

Intelligence

File Origin
# of uploads :
1
# of downloads :
133
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Detection(s):
SecuriteInfo.com.W32.AIDetect.malware2.19982.11373.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Сreating synchronization primitives
DNS request
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/619c046e398e2553d201382b/reports/0f2c9036-96ec-4166-8f08-6e449a0ca9fe/overview
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/3761f49f-0e43-483d-a30b-ce86b77d7e5c
Result
Threat name:
Dridex
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
72 / 100
Link:
https://www.joesandbox.com/analysis/894234
Signature
C2 URLs / IPs found in malware configuration
Found malware configuration
Multi AV Scanner detection for submitted file
Tries to delay execution (extensive OutputDebugStringW loop)
Yara detected Dridex unpacked file
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 526711 Sample: SecuriteInfo.com.W32.AIDete... Startdate: 22/11/2021 Architecture: WINDOWS Score: 72 40 188.165.214.166 OVHFR France 2->40 42 67.207.95.35 DIGITALOCEAN-ASNUS United States 2->42 44 2 other IPs or domains 2->44 46 Found malware configuration 2->46 48 Multi AV Scanner detection for submitted file 2->48 50 Yara detected Dridex unpacked file 2->50 52 C2 URLs / IPs found in malware configuration 2->52 9 loaddll32.exe 1 2->9         started        signatures3 process4 process5 11 rundll32.exe 9->11         started        14 rundll32.exe 9->14         started        16 rundll32.exe 9->16         started        18 4 other processes 9->18 signatures6 54 Tries to delay execution (extensive OutputDebugStringW loop) 11->54 20 WerFault.exe 9 11->20         started        22 WerFault.exe 14->22         started        24 WerFault.exe 14->24         started        26 WerFault.exe 16->26         started        28 WerFault.exe 16->28         started        30 rundll32.exe 18->30         started        32 WerFault.exe 9 18->32         started        34 WerFault.exe 2 9 18->34         started        36 2 other processes 18->36 process7 process8 38 WerFault.exe 23 9 30->38         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ddcaa1c7ba38d83e0f34da7cce150905cd0246f15334b9feadd8dcab5cd991ee/
Threat name:
Win32.Infostealer.Dridex
Create hunting rule
Status:
Malicious
First seen:
2021-11-22 20:04:33 UTC
File Type:
PE (Dll)
AV detection:
19 of 27 (70.37%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
doppeldridex
Create hunting rule
dridex
Create hunting rule
Similar samples:
2dd54462c65a469a2611be091d84fa71a4c1b5b61d020f4058296153941d9e13
Dridex
5aab487dfb1bd8c811dcc0fa8c9c9e762bb8df69424fd585d60a4bba53664599
Dridex
bb8481137fc9cc71e49c6a2aefb846091f1810ad9d17b71d64713cda7cb9d3a3
Dridex
c1194b3b9e8e8900d6010d77874ad396c67272a57d526db7d21887a90bcbdbe4
Dridex
cc31d1c3648d35d98c16d49ff17e290b07f431ccd23434b50c905c2aa4ba8f38
Dridex
ed8defd4e1e81fbc877f7419d6593303403504f4ea02de07085ea94d6ad78e18
Dridex
ee1259ba7e41be5e8f11fb7ed2fb983bd9a48e757cf59690336aa63ac2497dba
Dridex
+ 5'447 additional samples on MalwareBazaar
Result
Malware family:
dridex
Create hunting rule
Score:
  10/10
Tags:
family:dridex botnet:22203 botnet loader
Link:
https://tria.ge/reports/211122-zr631sghak/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Dridex Loader
Dridex
Malware Config
C2 Extraction:
67.207.95.35:443
86.107.98.232:8333
188.165.214.166:4664
144.91.110.219:9217
Unpacked files
SH256 hash:
c9a4621fd7c05fd84cdb4381789f16aee72635f116a5d5cca98b9d89e4069a9b
MD5 hash:
25e08102352d83395dbceb0445cb88d8
SHA1 hash:
9994341a7280113e0a09fbcd503a359b112d40dd
Detections:
win_dridex_auto
Create hunting rule
Link:
https://www.unpac.me/results/5e7ecd30-2b66-43e0-88a6-0ed35eccc007/
Parent samples :
cc31d1c3648d35d98c16d49ff17e290b07f431ccd23434b50c905c2aa4ba8f38
2dd54462c65a469a2611be091d84fa71a4c1b5b61d020f4058296153941d9e13
ee1259ba7e41be5e8f11fb7ed2fb983bd9a48e757cf59690336aa63ac2497dba
92a5ea2c1f1cc5177f54568b6d6b878f46a2bd3e49daf93f6385d304dcc1ee40
ba5fb468274de91023a4b8d14ff5b79a5531fed3cc818cdc93969b5fdb1a309d
b169abddcc96b1c9b61cd112734ad9e1d13af76ac9eb33b12c00fec870ed322d
2db0e926b1d6d60ab8138c008be5cad1ee2dda7a2cbbd27496953a97464b7511
8cb564d0a6548b35d96707b24a90ec361d82098f25381257fb8300ee5d27c6dc
106cd82325eacb5a9eedef1a7e54a9ad4e982469abe0b54583fbd4b8a0bd35f2
553cce1f64c0364094da5b64103f5bf184559eb9a4f7ebc5e14897b89ab6eda1
887f1d15b4c5a13871220261516df2fdb3410ed7a8b6088deee0d38610cbe68a
5aab487dfb1bd8c811dcc0fa8c9c9e762bb8df69424fd585d60a4bba53664599
ddcaa1c7ba38d83e0f34da7cce150905cd0246f15334b9feadd8dcab5cd991ee
b1029b6074fcc508c36bfd3c9c1ec582da3650faae2a9af1eb867ad3e05fc513
5cb8c6baf6d41a0dd663d092ebb31ef7bdaa4370fb0f8cb6fd35b6a8744f31c9
be193b9e9d20df4110f8da469af38bb99f445a173b13d1941da6be8d8c81d1fd
5092d010953226e366db6d47af4bf9886179ea6eb2655f3e70d4a1a82af1c7d5
SH256 hash:
d3eda259ac4400e94bf0a65778ce4f9aa19f8ea90561eb46acea00f291b1ebf1
MD5 hash:
40d995be6540a74aadf771c66b193c5b
SHA1 hash:
7afa3f952a3d0dd0a32a77b14a60702612186853
Detections:
win_doppeldridex_auto
Create hunting rule
Link:
https://www.unpac.me/results/5e7ecd30-2b66-43e0-88a6-0ed35eccc007/
SH256 hash:
ddcaa1c7ba38d83e0f34da7cce150905cd0246f15334b9feadd8dcab5cd991ee
MD5 hash:
6aea9136fa38aeefa0a18df7264aeb61
SHA1 hash:
31a8bc5417574b89ef37c2134cc93beb87fed4ed
Link:
https://www.unpac.me/results/5e7ecd30-2b66-43e0-88a6-0ed35eccc007/
Malware family:
Dridex
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/ddcaa1c7ba38/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.14
Link:
https://yomi.yoroi.company/submissions/ddcaa1c7ba38d83e0f34da7cce150905cd0246f15334b9feadd8dcab5cd991ee

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Dridex

DLL dll ddcaa1c7ba38d83e0f34da7cce150905cd0246f15334b9feadd8dcab5cd991ee

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1806231/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/208388/

Comments