🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e19ae4ea423a7210e27c0c58deb9ae5a77d1d9c8a4020051210290c53e69bebf. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Dridex


Vendor detections: 11


Intelligence 11 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e19ae4ea423a7210e27c0c58deb9ae5a77d1d9c8a4020051210290c53e69bebf
SHA3-384 hash: 644162e96c6a0f3f1b2e48c53a00f1f749f1c2eac3ec248a86f794442d985eec033dc125ccfc71a9c19ec88d96984dcb
SHA1 hash: af025887a6b5f60d60ea239a61c1f900797316c6
MD5 hash: 700b431b0ed383e238d98418fa5c54ce
humanhash: kansas-happy-equal-cardinal
File name:SecuriteInfo.com.W32.AIDetect.malware1.3909.11015
Download: download sample
Signature Dridex
Create hunting rule
File size:520'192 bytes
First seen:2021-12-17 23:07:30 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash 1d03489a888f9eb61ae369ecc7b0879f (11 x Dridex)
ssdeep 6144:elkqY8IIaCme+UOwOYEKdvfrlEe/ply5ovxlbL6B4Q0UY:y3BdvlDx5OFY
Threatray 5'620 similar samples on MalwareBazaar
TLSH T190B4BFAFC65E1478C7E31870159143B12EA640C6097ADEAF6B2FFA9C149634C227DB7C
Reporter SecuriteInfoCom
Tags:dll Dridex

Intelligence

File Origin
# of uploads :
1
# of downloads :
155
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Detection(s):
SecuriteInfo.com.W32.AIDetect.malware1.3909.11015.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
DNS request
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
67%
Tags:
dridex packed wacatac
Link:
https://www.filescan.io/uploads/61bd18558991ba72b38a3cf7/reports/79818ce9-826b-45a7-b70a-1d9c2000163c/overview
Malware family:
Dridex
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/4b2f85fb-c75c-4a92-8b85-b5536cec82e6
Result
Threat name:
Dridex
Create hunting rule
Detection:
malicious
Classification:
troj
Score:
72 / 100
Link:
https://www.joesandbox.com/analysis/909380
Signature
C2 URLs / IPs found in malware configuration
Found malware configuration
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Yara detected Dridex unpacked file
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 541858 Sample: SecuriteInfo.com.W32.AIDete... Startdate: 18/12/2021 Architecture: WINDOWS Score: 72 18 37.59.74.180 OVHFR France 2->18 20 194.9.172.107 FEELBFR unknown 2->20 22 2 other IPs or domains 2->22 26 Found malware configuration 2->26 28 Multi AV Scanner detection for submitted file 2->28 30 Yara detected Dridex unpacked file 2->30 32 2 other signatures 2->32 9 loaddll32.exe 1 2->9         started        signatures3 process4 process5 11 cmd.exe 1 9->11         started        process6 13 rundll32.exe 11->13         started        process7 15 WerFault.exe 23 9 13->15         started        dnsIp8 24 192.168.2.1 unknown unknown 15->24
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e19ae4ea423a7210e27c0c58deb9ae5a77d1d9c8a4020051210290c53e69bebf/
Threat name:
Win32.Infostealer.Dridex
Create hunting rule
Status:
Malicious
First seen:
2021-12-17 23:08:10 UTC
File Type:
PE (Dll)
AV detection:
23 of 28 (82.14%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=4gnoj2schjzbbyt4brmn5onolj35dwoiuqbaaujbakimkptjx27q._file
Verdict:
malicious
Label(s):
doppeldridex
Create hunting rule
dridex
Create hunting rule
Similar samples:
18ac333e84ab0105867bd3a76128c76fce6c3892f204871c4b746a4309113dfa
Dridex
492fe6caf5e12dcb484f636079c246fbf0ab4b8ed59e8e5a61131dbd1fd4d2be
Dridex
6477f31e018582791a793ff0c0273f9f2b43139c0b25a88772cb90a72111f6bb
Dridex
7dd71dac4d68a8d49db4b0077f38225b597591ee52f96fd832acfa552d166979
Dridex
7e4eb05983026790d6874df967ef5d1d00fcea1e2841a8f7d333b727d3d8dcf4
Dridex
d0681c030a51811edc6f19b6cc418043ef928e251c681cdf75a05949f932340b
Dridex
fa6aea596a04b6bd957babd156bbd40cafa2b0662390cc2fd30953fb48ec61fc
Dridex
fd7658cdf31389ef24c2767f2f909a4b71de55a1232e84c0575675df7bb2faf7
Dridex
+ 5'610 additional samples on MalwareBazaar
Result
Malware family:
dridex
Create hunting rule
Score:
  10/10
Tags:
family:dridex botnet:22202 botnet loader
Link:
https://tria.ge/reports/211217-24jjlafahl/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Dridex Loader
Dridex
Malware Config
C2 Extraction:
144.91.122.94:443
167.99.141.108:4664
37.59.74.180:593
194.9.172.107:9217
Unpacked files
SH256 hash:
86f9adfd449267d0a19499553324ff89a1bc4cd36812d1338e4cd950bb01ff52
MD5 hash:
9165e9c2f16694e93ce63d8c7bc06170
SHA1 hash:
0ea1b4b0ab1efe36e20e16b09bad85c0c5350151
Detections:
win_doppeldridex_auto
Create hunting rule
Link:
https://www.unpac.me/results/fc83ad48-c7a4-4a91-a0b8-fb1d426e74bd/
SH256 hash:
ebaa618f536bf21ad859f90dd159f06e787b9759d48ac941e28161b6b300c6bd
MD5 hash:
627a661c84e6933f4e610accdb03e454
SHA1 hash:
94489fd653d36bb2a281b43217053e22110b196b
Detections:
win_dridex_auto
Create hunting rule
Link:
https://www.unpac.me/results/fc83ad48-c7a4-4a91-a0b8-fb1d426e74bd/
Parent samples :
0b42235d0b3a9340f79d7f30a747bb13a08c50c10b9da71ae560779eb14707b3
aa273a0d181ce95a4c27507000f9d961b975fc66ec321038a1c79e7fcc3bec8e
f23745be4a29f0b56b0fbaaf198aabdbf564f3e94c07307bb95210f5f031f56b
5257f6fde23867385a6fcd7f7d3cdddcce7efaba930158c7a853404480f3d2b9
e00dc545e5e75f7d3d2464846c69cba30ea7f0e86ad7960501c392e19285de7e
c8d544a6c242125c56e07c45351275e1e7a7af11a7b97eef9b3a4896689b030d
d3550092442ef0151dfd4be717ba00c9738a897ffbce52dfb68e20e652fa664b
fa6c655808971ccaccc20df19ea71ad73cc93d369e7939dc8eda4db581d19cfc
1bb547b713a473c810dce54abf20d1e8a91070026a597ef94a189ea9639b3899
e19ae4ea423a7210e27c0c58deb9ae5a77d1d9c8a4020051210290c53e69bebf
b929cc97d96824f57a2ad86365b5fc5d1aaa75ab99484e207b567615d6f3e777
SH256 hash:
e19ae4ea423a7210e27c0c58deb9ae5a77d1d9c8a4020051210290c53e69bebf
MD5 hash:
700b431b0ed383e238d98418fa5c54ce
SHA1 hash:
af025887a6b5f60d60ea239a61c1f900797316c6
Link:
https://www.unpac.me/results/fc83ad48-c7a4-4a91-a0b8-fb1d426e74bd/
Malware family:
Dridex
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/e19ae4ea423a/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.96
Link:
https://yomi.yoroi.company/submissions/e19ae4ea423a7210e27c0c58deb9ae5a77d1d9c8a4020051210290c53e69bebf

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Dridex

DLL dll e19ae4ea423a7210e27c0c58deb9ae5a77d1d9c8a4020051210290c53e69bebf

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1894124/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/214908/

Comments