🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e07ae56f0cb20f2bc6a9a5dab953bd97e4a4c2047d784dab106d3fd3eb535b3c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Dridex


Vendor detections: 10


Intelligence 10 IOCs YARA 2 File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e07ae56f0cb20f2bc6a9a5dab953bd97e4a4c2047d784dab106d3fd3eb535b3c
SHA3-384 hash: d9233edb622dcf5ba196fd19d660b32e0fb1c87040a3064786b7123e806e70f50f23385b003e3196e167633d764c2d94
SHA1 hash: cb1e795ba0578f99cc7172034c52daa77cf8684e
MD5 hash: 8ba232fa928c7e69201f47f0cf216001
humanhash: mike-spaghetti-ink-foxtrot
File name:8ba232fa928c7e69201f47f0cf216001
Download: download sample
Signature Dridex
Create hunting rule
File size:768'000 bytes
First seen:2021-10-27 17:00:01 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash 25cb031fe02365eafb637dd0a2254650 (34 x Dridex)
ssdeep 12288:OhB6OmN5lx6S3P8UUY9eHTYtI6jd/Tvyis6SX3hwxwXcKjNE3l7w31TwMGjc/fc:O0LUY9eziI6NT6JtXxwGNCl831TCY/f
Threatray 988 similar samples on MalwareBazaar
TLSH T13BF4CF1336EAC079D072157841A0B5E05DCDBE61642E9EEBA390323E863ACD2797D71F
Reporter zbetcheckin
Tags:32 dll Dridex exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
135
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/200667/
Detection(s):
SecuriteInfo.com.Trojan.Win32.Sabsik.FL.Bml.21232.7887.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
greyware
Link:
https://www.filescan.io/uploads/61798598db358dd15ee0516e/reports/6fc53c88-e0f9-4d46-ab8e-7334cfd7a79f/overview
Malware family:
Dridex
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/c3d03920-8649-403a-967d-895e475851f5
Result
Threat name:
Dridex
Create hunting rule
Detection:
malicious
Classification:
bank.troj.evad
Score:
88 / 100
Link:
https://www.joesandbox.com/analysis/877962
Signature
C2 URLs / IPs found in malware configuration
Detected Dridex e-Banking trojan
Found malware configuration
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
System process connects to network (likely due to code injection or exploit)
Yara detected Dridex unpacked file
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 510394 Sample: csp3vt5m3F Startdate: 27/10/2021 Architecture: WINDOWS Score: 88 28 Found malware configuration 2->28 30 Multi AV Scanner detection for submitted file 2->30 32 Yara detected Dridex unpacked file 2->32 34 2 other signatures 2->34 7 loaddll32.exe 13 2->7         started        process3 signatures4 38 Detected Dridex e-Banking trojan 7->38 10 cmd.exe 1 7->10         started        12 rundll32.exe 7->12         started        14 rundll32.exe 7->14         started        16 rundll32.exe 7->16         started        process5 process6 18 rundll32.exe 12 10->18         started        dnsIp7 22 185.56.219.47, 49763, 49765, 49772 KELIWEBIT Italy 18->22 24 192.46.210.220, 443, 49752, 49755 FRAUNHOFER-CLUSTER-BWResearchInstitutesspreadalloverGe United States 18->24 26 2 other IPs or domains 18->26 36 System process connects to network (likely due to code injection or exploit) 18->36 signatures8
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e07ae56f0cb20f2bc6a9a5dab953bd97e4a4c2047d784dab106d3fd3eb535b3c/
Threat name:
Win32.Infostealer.Dridex
Create hunting rule
Status:
Malicious
First seen:
2021-10-27 17:00:07 UTC
AV detection:
10 of 28 (35.71%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=4b5ok3ymwihsxrvjuxnlsu55s7skjqqepv4e3kyqnu75h22tlm6a._file
Verdict:
malicious
Label(s):
dridex
Create hunting rule
gozi
Create hunting rule
Similar samples:
00980f874952ec18d463f4e574e7e4c4c2ed948b4a295285dc740a8ee2ccafd1
Dridex
0e1a864b3d7d4dafb191dc6614c4b3f43fab1d9970d37e5900cbc1d1a11524df
Dridex
2ec8b3b5d5d94269fd4db4f1569f6d853f9e1c4543450b40acda09e0a273d666
Dridex
4ef0bd084a312b416f819ea598abb6959f2163f2da9537bdee4d430b2a3ba370
Dridex
a08a30310095aee3818cb1aed38a87f36c6b2c0466ac483baf6f5319b54ed75b
Dridex
a728c51b40b9aa217a0e6b7d27d389325bbe2ff7a275c2a764a2a651d2c7c940
Dridex
a9734decc445148d3c25da89de8452032fd6cd65530e5733c02576d14abb746d
Dridex
c721d124999fe9388e49688994b3316a0b7c4735f96012a5efa20e1aabf87188
Dridex
fab5fce8f2f594e2570831bc801ea223169e432c4159312f6546721d8eac6fb5
Dridex
+ 978 additional samples on MalwareBazaar
Result
Malware family:
dridex
Create hunting rule
Score:
  10/10
Tags:
family:dridex botnet:10555 botnet discovery evasion trojan
Link:
https://tria.ge/reports/211027-vhzkcsfgd8/
Behaviour
Suspicious use of WriteProcessMemory
Checks installed software on the system
Checks whether UAC is enabled
Blocklisted process makes network request
Dridex
Malware Config
C2 Extraction:
192.46.210.220:443
143.244.140.214:808
45.77.0.96:6891
185.56.219.47:8116
Unpacked files
SH256 hash:
4f1c5ad4a201526b46ab77f3d71841a8bf3a3adde2a4a51fc0dc2d132302a39b
MD5 hash:
1edeebbd2aade141a56f5b2cc44ffda9
SHA1 hash:
bcaed3ecb2862979fda5a52700ac3e01fb4fd658
Link:
https://www.unpac.me/results/4676d683-a7c6-43b0-b102-58da2d7837b7/
SH256 hash:
e07ae56f0cb20f2bc6a9a5dab953bd97e4a4c2047d784dab106d3fd3eb535b3c
MD5 hash:
8ba232fa928c7e69201f47f0cf216001
SHA1 hash:
cb1e795ba0578f99cc7172034c52daa77cf8684e
Link:
https://www.unpac.me/results/4676d683-a7c6-43b0-b102-58da2d7837b7/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/e07ae56f0cb20f2bc6a9a5dab953bd97e4a4c2047d784dab106d3fd3eb535b3c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DridexLoader
Create hunting rule
Author:kevoreilly
Description:Dridex v4 dropper C2 parsing function
Rule name:win_dridex_loader_v2
Create hunting rule
Author:Johannes Bader @viql
Description:detects some Dridex loaders

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Dridex

DLL dll e07ae56f0cb20f2bc6a9a5dab953bd97e4a4c2047d784dab106d3fd3eb535b3c

(this sample)

  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/200667/
  
URLhaus
https://urlhaus.abuse.ch/url/1720558/

Comments


Avatar
zbet commented on 2021-10-27 17:00:02 UTC

url : hxxps://en.dsdkochoracin.com.mk/rymp5f.rar