🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ecf60d585aad070feca119d7bfbf3f929c23da7cde1a2e988abd828cee5b8bc5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Dridex


Vendor detections: 9


Intelligence 9 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ecf60d585aad070feca119d7bfbf3f929c23da7cde1a2e988abd828cee5b8bc5
SHA3-384 hash: c686d197d53bd79394813a37d1c87ac6bf1c288538008cb7cee6d60852a8b605939b8b8f3e8cee09b0fe2758c2384520
SHA1 hash: ced60dff8dd3f5d4a592b2097b0cbd77fa749f22
MD5 hash: cf56f7caf6a6d3f2f1c14c84e9867ae8
humanhash: pizza-cup-johnny-seven
File name:SecuriteInfo.com.W32.AIDetect.malware1.3988.28638
Download: download sample
Signature Dridex
Create hunting rule
File size:786'432 bytes
First seen:2021-11-30 00:41:06 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash caa5f78b710a1e69e3b6a0df7c9b8051 (3 x Dridex)
ssdeep 12288:nsBI3CnCjqHi747SL47gZEvkdqtA1Gb05yfin8hqfoXq3kNYjaJghss6rC+ZgUDM:nsmyC2Ccu0U2skOcgY68Yga0KOCa4MJc
Threatray 5'480 similar samples on MalwareBazaar
TLSH T1F9F49E6B97EA0605E1C38A3ACF15D29368B38C459C075AD7A908EF9D443D72F4CFD24A
Reporter SecuriteInfoCom
Tags:dll Dridex

Intelligence

File Origin
# of uploads :
1
# of downloads :
176
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.W32.AIDetect.malware1.3988.28638.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/61a5735cc4c5314148228967/reports/e8e5d45f-5009-4422-a135-b980e84776d8/overview
Malware family:
Dridex
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/67c72309-dace-4a15-b83e-e1b35fd03601
Result
Threat name:
Dridex
Create hunting rule
Detection:
malicious
Classification:
troj
Score:
68 / 100
Link:
https://www.joesandbox.com/analysis/898357
Signature
C2 URLs / IPs found in malware configuration
Found malware configuration
Multi AV Scanner detection for submitted file
Yara detected Dridex unpacked file
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 530835 Sample: SecuriteInfo.com.W32.AIDete... Startdate: 30/11/2021 Architecture: WINDOWS Score: 68 37 23.253.208.162 RACKSPACEUS United States 2->37 39 51.68.138.110 OVHFR France 2->39 41 2 other IPs or domains 2->41 43 Found malware configuration 2->43 45 Multi AV Scanner detection for submitted file 2->45 47 Yara detected Dridex unpacked file 2->47 49 C2 URLs / IPs found in malware configuration 2->49 9 loaddll32.exe 1 2->9         started        signatures3 process4 process5 11 rundll32.exe 9->11         started        13 rundll32.exe 9->13         started        15 cmd.exe 1 9->15         started        17 4 other processes 9->17 process6 19 WerFault.exe 2 9 11->19         started        21 WerFault.exe 11->21         started        23 WerFault.exe 9 13->23         started        25 WerFault.exe 13->25         started        27 rundll32.exe 15->27         started        29 WerFault.exe 9 17->29         started        31 WerFault.exe 11 17->31         started        33 WerFault.exe 17->33         started        process7 35 WerFault.exe 23 9 27->35         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ecf60d585aad070feca119d7bfbf3f929c23da7cde1a2e988abd828cee5b8bc5/
Threat name:
Win32.Trojan.Drixed
Create hunting rule
Status:
Malicious
First seen:
2021-11-29 22:46:32 UTC
File Type:
PE (Dll)
AV detection:
23 of 44 (52.27%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
doppeldridex
Create hunting rule
dridex
Create hunting rule
Similar samples:
137a3b1d2ae58f70052f259434e04a9cbf8d10e54533ef3f9359c03fc4ccb56f
Dridex
26a7de83424d94c22548e9b135d55093525009ed266a919983a7c791a9f35a97
Dridex
43000935e1429219cc2cdae2f7d1533bc983cc0e2dbfcbefddca71e8c78de0e8
Dridex
a76bc3d7145311be213e3d4ef16a7840208dbf6d354b543c52822dc2ecaa7a6c
Dridex
bed6059a3a6d51ff59bac895b36eb623a9b0d50b02f01d4ff0c4e37bc7a8bfb2
Dridex
e7c74e4d190b77f63788a032c28c4c4a819edc736697152f0a3e217aba7f5e97
Dridex
f00b059996a930e014c289a343b2f050bd52108f0a1e32da58fcda3f54ab2ed6
Dridex
f4da618ff77a88dc769e3e6c7c0614a4975ca65b400688ee21233894cd311a0f
Dridex
f568ca21783a16fa33481c04a09d120c5127b444c7ffe6491e2cd24fa368e917
Dridex
+ 5'470 additional samples on MalwareBazaar
Result
Malware family:
dridex
Create hunting rule
Score:
  10/10
Tags:
family:dridex botnet:22201 botnet loader
Link:
https://tria.ge/reports/211130-a2cvgsdafr/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Dridex Loader
Dridex
Malware Config
C2 Extraction:
51.68.138.110:443
206.189.150.190:8116
103.109.247.10:10443
23.253.208.162:9217
Unpacked files
SH256 hash:
59e77eb1012b9fe77602363d57be0e3cc83ec672555a0cb7e874f3e46434632d
MD5 hash:
f20b3b93178a31bea89f73adb1910dde
SHA1 hash:
ce171cafab55900b07e73682af6eda62172d6f2c
Detections:
win_doppeldridex_auto
Create hunting rule
Link:
https://www.unpac.me/results/2777501e-b890-4808-84c1-21220f6b2fa9/
SH256 hash:
11c32c1c4ebc371679bd4a42621187249aebf9f796c9b2c38bb54d7701c9771e
MD5 hash:
1548250711b2aa68af9879cf8889d67d
SHA1 hash:
9b59687a667eca04f622b0f54c282ced759688ad
Detections:
win_dridex_auto
Create hunting rule
Link:
https://www.unpac.me/results/2777501e-b890-4808-84c1-21220f6b2fa9/
Parent samples :
a76bc3d7145311be213e3d4ef16a7840208dbf6d354b543c52822dc2ecaa7a6c
ecf60d585aad070feca119d7bfbf3f929c23da7cde1a2e988abd828cee5b8bc5
829f13568010cc4644dadad0f30c41686b4eb5c8c5959502aac3d9a4a47c7dba
SH256 hash:
ecf60d585aad070feca119d7bfbf3f929c23da7cde1a2e988abd828cee5b8bc5
MD5 hash:
cf56f7caf6a6d3f2f1c14c84e9867ae8
SHA1 hash:
ced60dff8dd3f5d4a592b2097b0cbd77fa749f22
Link:
https://www.unpac.me/results/2777501e-b890-4808-84c1-21220f6b2fa9/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.14
Link:
https://yomi.yoroi.company/submissions/ecf60d585aad070feca119d7bfbf3f929c23da7cde1a2e988abd828cee5b8bc5

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DridexV4
Create hunting rule
Author:kevoreilly
Description:Dridex v4 Payload
Rule name:MALWARE_Win_DLLLoader
Create hunting rule
Author:ditekSHen
Description:Detects unknown DLL Loader
Rule name:win_dridex_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.dridex.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Dridex

DLL dll ecf60d585aad070feca119d7bfbf3f929c23da7cde1a2e988abd828cee5b8bc5

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1833742/
  
Delivery method
Distributed via web download

Comments