🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 dee4e7db5288498de87f415981fbaec17e88dc9fdef3dbcc5aac39395aafe5ea. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Dridex


Vendor detections: 11


Intelligence 11 IOCs YARA 8 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: dee4e7db5288498de87f415981fbaec17e88dc9fdef3dbcc5aac39395aafe5ea
SHA3-384 hash: ad06978a31cbc3db2f10949cb91c2724f3948e237111a7930dd763dd2e39508e9b1adee4bfe7177a8f5a45b439c1147d
SHA1 hash: 11298005d3e50458430c52c2d5d17f0a9957aa4f
MD5 hash: c27cf2cfbe97a0f22dcaa9c019e4013c
humanhash: blue-nevada-mobile-aspen
File name:SecuriteInfo.com.Trojan.Dridex.777.4657.28090
Download: download sample
Signature Dridex
Create hunting rule
File size:668'520 bytes
First seen:2021-11-17 23:02:39 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash b7c97a32f8446f2667c75327c69c37cd (3 x Dridex)
ssdeep 6144:bHG2WUYYUeWUkWk+WUCWUmWUOWUwWUA4UUWqqWUGWU8YUCWC4WUiWUrHw9GlzgYE:6OHwszfO5snBpZf4w0uAX
TLSH T1BAE4B01E7188C05BC5CAACB974B37B646585943C2DE9A4F7F06336A8D74B2B8BC17078
Reporter SecuriteInfoCom
Tags:dll Dridex

Intelligence

File Origin
# of uploads :
1
# of downloads :
165
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Detection(s):
SecuriteInfo.com.Trojan.Dridex.777.4657.28090.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
DNS request
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
overlay packed
Link:
https://www.filescan.io/uploads/61958a294912a8c920a1eb0d/reports/a0d5d9ae-1aa4-4c5c-978a-ebdd954faa34/overview
Malware family:
Dridex
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/f57d5096-12f5-42d4-b762-24c9460d0d99
Result
Threat name:
Dridex
Create hunting rule
Detection:
malicious
Classification:
troj
Score:
68 / 100
Link:
https://www.joesandbox.com/analysis/891601
Signature
C2 URLs / IPs found in malware configuration
Found malware configuration
Multi AV Scanner detection for submitted file
Yara detected Dridex unpacked file
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 524074 Sample: SecuriteInfo.com.Trojan.Dri... Startdate: 18/11/2021 Architecture: WINDOWS Score: 68 17 54.37.70.105 OVHFR France 2->17 19 142.93.218.86 DIGITALOCEAN-ASNUS United States 2->19 21 2 other IPs or domains 2->21 23 Found malware configuration 2->23 25 Multi AV Scanner detection for submitted file 2->25 27 Yara detected Dridex unpacked file 2->27 29 C2 URLs / IPs found in malware configuration 2->29 9 loaddll32.exe 1 2->9         started        signatures3 process4 process5 11 cmd.exe 1 9->11         started        process6 13 rundll32.exe 11->13         started        process7 15 WerFault.exe 23 9 13->15         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/dee4e7db5288498de87f415981fbaec17e88dc9fdef3dbcc5aac39395aafe5ea/
Threat name:
Win32.Downloader.Convagent
Create hunting rule
Status:
Malicious
First seen:
2021-11-17 23:03:04 UTC
AV detection:
15 of 28 (53.57%)
Threat level:
  3/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=33sopw2srbey32d7ifmyd65oyf7irxe733z5xtc2vq4tswvp4xva._file
Verdict:
malicious
Label(s):
doppeldridex
Create hunting rule
dridex
Create hunting rule
Result
Malware family:
dridex
Create hunting rule
Score:
  10/10
Tags:
family:dridex botnet:22203 botnet loader
Link:
https://tria.ge/reports/211117-21nzxaecc6/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Dridex Loader
Dridex
Malware Config
C2 Extraction:
54.37.70.105:443
198.199.70.22:6602
164.68.99.3:5007
142.93.218.86:4664
Unpacked files
SH256 hash:
67ef5a4eae647c84bbf565127189d693aea067ac3c4263ace6804f8621afd086
MD5 hash:
f59d5559c9766bf2790c5705fe31342f
SHA1 hash:
f08f79ba565702b6987d2b50448eac449f9ebe12
Detections:
win_dridex_auto
Create hunting rule
Link:
https://www.unpac.me/results/e5ac1068-1fe9-4d6c-9031-1baa18db77e5/
Parent samples :
dee4e7db5288498de87f415981fbaec17e88dc9fdef3dbcc5aac39395aafe5ea
32d586a56d67479bfb6a97af3946d36eef30763c090fe183ea859235b2b41be2
caaac89a744e94aa0735d858e6d30445a5f92e7fe4c9bdbcd1a1bd92e626fcc7
SH256 hash:
419a7e155a79a27529bdf0fde7458fe42a03603d666929cc0eefa55a00a67077
MD5 hash:
093d32ae69cb16018b9fb60097a8c080
SHA1 hash:
a377c8095cab83cfff8afc647c9ae18e49d0cd75
Detections:
win_doppeldridex_auto
Create hunting rule
Link:
https://www.unpac.me/results/e5ac1068-1fe9-4d6c-9031-1baa18db77e5/
SH256 hash:
dee4e7db5288498de87f415981fbaec17e88dc9fdef3dbcc5aac39395aafe5ea
MD5 hash:
c27cf2cfbe97a0f22dcaa9c019e4013c
SHA1 hash:
11298005d3e50458430c52c2d5d17f0a9957aa4f
Link:
https://www.unpac.me/results/e5ac1068-1fe9-4d6c-9031-1baa18db77e5/
Malware family:
Dridex
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/dee4e7db5288/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/dee4e7db5288498de87f415981fbaec17e88dc9fdef3dbcc5aac39395aafe5ea

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DridexLoader
Create hunting rule
Author:kevoreilly
Description:Dridex v4 dropper C2 parsing function
Rule name:DridexV4
Create hunting rule
Author:kevoreilly
Description:Dridex v4 Payload
Rule name:dridex_loader
Create hunting rule
Author:kevoreilly
Description:Dridex Loader
Rule name:MALWARE_Win_DLLLoader
Create hunting rule
Author:ditekSHen
Description:Detects unknown DLL Loader
Rule name:Sectigo_Code_Signed
Create hunting rule
Description:Detects code signed by the Sectigo RSA Code Signing CA
Reference:https://bazaar.abuse.ch/export/csv/cscb/
Rule name:Sectigo_Code_Signed
Create hunting rule
Description:Detects code signed by the Sectigo RSA Code Signing CA
Reference:https://bazaar.abuse.ch/export/csv/cscb/
Rule name:win_doppeldridex_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.doppeldridex.
Rule name:win_dridex_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.dridex.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Dridex

DLL dll dee4e7db5288498de87f415981fbaec17e88dc9fdef3dbcc5aac39395aafe5ea

(this sample)

Cape
Cape
https://www.capesandbox.com/analysis/207019/
  
URLhaus
https://urlhaus.abuse.ch/url/1798266/
  
Delivery method
Distributed via web download

Comments