🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ed8defd4e1e81fbc877f7419d6593303403504f4ea02de07085ea94d6ad78e18. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Dridex


Vendor detections: 9


Intelligence 9 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ed8defd4e1e81fbc877f7419d6593303403504f4ea02de07085ea94d6ad78e18
SHA3-384 hash: 17323d69901cf443817ccb49a4a020a31af3573b9ecd3b0a64d0e6e6744e1d5780fc88317510cbb96df2143ec689b3d0
SHA1 hash: 53cc0a4f5cf33f4dbf683da5bd27bcdeabbca4f8
MD5 hash: 2f664dacdb5ae1543d5d68415bb58bd5
humanhash: washington-colorado-purple-network
File name:SecuriteInfo.com.Trojan.Dridex.777.10448.29964
Download: download sample
Signature Dridex
Create hunting rule
File size:439'144 bytes
First seen:2021-11-22 20:55:47 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash 3f84747faed4a03ac4a29c71aec18674 (20 x Dridex)
ssdeep 12288:mpY+i26s0+yheTEuvIKRcUDoWdIcgTUEtHkIGixsCCo+pxq:mGtddZwrnzPDgQE6IGIsggxq
Threatray 5'457 similar samples on MalwareBazaar
TLSH T14F94B04441876A71F65115F8BEDB3AF2BCB3CC7EF4E05E1D2208489B2F4F15640AA6B6
Reporter SecuriteInfoCom
Tags:dll Dridex signed

Code Signing Certificate

Organisation:STAND ALONE MUSIC LTD
Issuer:Sectigo RSA Code Signing CA
Algorithm:sha256WithRSAEncryption
Valid from:2020-12-07T00:00:00Z
Valid to:2021-12-07T23:59:59Z
Serial number: 3b777165b125bccc181d0bac3f5b55b3
Intelligence: 55 malware samples on MalwareBazaar are signed with this code signing certificate
MalwareBazaar Blocklist:This certificate is on the MalwareBazaar code signing certificate blocklist (CSCB)
Thumbprint Algorithm:SHA256
Thumbprint: f680fab6a9d21e8e76003c5c28b3c5084866d7ac85cf0cfb5aaa02f69ee99f1e
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin
# of uploads :
1
# of downloads :
103
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Detection(s):
SecuriteInfo.com.Trojan.Dridex.777.10448.29964.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Сreating synchronization primitives
Sending a custom TCP request
DNS request
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
overlay packed
Link:
https://www.filescan.io/uploads/619c03fadd04e7d00e02beeb/reports/7cd8592a-99d8-4c5b-b4c5-5e8fa30aba3f/overview
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/20819b67-e70d-4bf8-a060-49822fa1b79e
Result
Threat name:
Dridex
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
72 / 100
Link:
https://www.joesandbox.com/analysis/894366
Signature
C2 URLs / IPs found in malware configuration
Found malware configuration
Multi AV Scanner detection for submitted file
Tries to delay execution (extensive OutputDebugStringW loop)
Yara detected Dridex unpacked file
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 526843 Sample: SecuriteInfo.com.Trojan.Dri... Startdate: 23/11/2021 Architecture: WINDOWS Score: 72 39 188.165.214.166 OVHFR France 2->39 41 67.207.95.35 DIGITALOCEAN-ASNUS United States 2->41 43 2 other IPs or domains 2->43 47 Found malware configuration 2->47 49 Multi AV Scanner detection for submitted file 2->49 51 Yara detected Dridex unpacked file 2->51 53 C2 URLs / IPs found in malware configuration 2->53 9 loaddll32.exe 1 2->9         started        signatures3 process4 process5 11 rundll32.exe 9->11         started        14 cmd.exe 1 9->14         started        16 rundll32.exe 9->16         started        18 4 other processes 9->18 signatures6 55 Tries to delay execution (extensive OutputDebugStringW loop) 11->55 20 WerFault.exe 9 11->20         started        22 rundll32.exe 14->22         started        24 WerFault.exe 2 9 16->24         started        26 WerFault.exe 16->26         started        28 WerFault.exe 9 18->28         started        30 WerFault.exe 18->30         started        32 WerFault.exe 18->32         started        34 2 other processes 18->34 process7 process8 36 WerFault.exe 23 9 22->36         started        dnsIp9 45 192.168.2.1 unknown unknown 36->45
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ed8defd4e1e81fbc877f7419d6593303403504f4ea02de07085ea94d6ad78e18/
Threat name:
Win32.Trojan.Drixed
Create hunting rule
Status:
Malicious
First seen:
2021-11-22 17:31:25 UTC
File Type:
PE (Dll)
AV detection:
20 of 28 (71.43%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
doppeldridex
Create hunting rule
dridex
Create hunting rule
Similar samples:
2dd54462c65a469a2611be091d84fa71a4c1b5b61d020f4058296153941d9e13
Dridex
5aab487dfb1bd8c811dcc0fa8c9c9e762bb8df69424fd585d60a4bba53664599
Dridex
bb8481137fc9cc71e49c6a2aefb846091f1810ad9d17b71d64713cda7cb9d3a3
Dridex
c1194b3b9e8e8900d6010d77874ad396c67272a57d526db7d21887a90bcbdbe4
Dridex
cc31d1c3648d35d98c16d49ff17e290b07f431ccd23434b50c905c2aa4ba8f38
Dridex
ddcaa1c7ba38d83e0f34da7cce150905cd0246f15334b9feadd8dcab5cd991ee
Dridex
ee1259ba7e41be5e8f11fb7ed2fb983bd9a48e757cf59690336aa63ac2497dba
Dridex
+ 5'447 additional samples on MalwareBazaar
Result
Malware family:
dridex
Create hunting rule
Score:
  10/10
Tags:
family:dridex botnet:22203 botnet loader
Link:
https://tria.ge/reports/211122-zq2f5sbhd4/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Dridex Loader
Dridex
Malware Config
C2 Extraction:
67.207.95.35:443
86.107.98.232:8333
188.165.214.166:4664
144.91.110.219:9217
Unpacked files
SH256 hash:
78c6a6e835d10c6eb61421e0d7a7df958dfab37974fa9b71c40cedfa09317be6
MD5 hash:
5e5c5a2ee5b77339ab395cf074d874a1
SHA1 hash:
d1a131933439404bf44fc6f494862745c9a4d213
Detections:
win_dridex_auto
Create hunting rule
Link:
https://www.unpac.me/results/11329582-0ba2-48f5-bd76-beb4899fd34a/
Parent samples :
f46403b87fbf1cf29998b7a5675b8e45903c380ed3765bbf4157efe552d652f9
97b0ac9dc97eb0778dce6676ce9872ce8b621ee3d7e7c4e00c642d033d7dfbae
f03f91696ce0ddd77a4f220753ab3aa8c838d18b4f55824143a5071a9d32d1c0
ed8defd4e1e81fbc877f7419d6593303403504f4ea02de07085ea94d6ad78e18
6aece6407d065eb07920b284b3175a6153bba568041b2cab4bdfcb0873577ea6
061f776afbe47244a114d956480c3371112b36ae3efaa679a730f9de465695b2
e223980a1fd0ad2f6674019e1f65113c30df79896ae08606eebfa2bcd56e982e
9cc73deb20bce4f6ddb48e575925d7eb583a34cfefb5635f3eb68954b8f4c75d
9a63b8546df4310d75234a37dabecb0e231876f897207e62e36831d08c0e7ac6
c9245778a049dc7e57228e0846f00ede4a62d779102772b628ba733beb2d149c
0ab7fef04ca81bddf9b7a2b17e7219fcaf4ee62836d614acbe17292223c88e49
ef626b3e8d15c5fd15664bdda8701891bb19e4fb9e1b746e6cecad30020fd944
bb8481137fc9cc71e49c6a2aefb846091f1810ad9d17b71d64713cda7cb9d3a3
c1194b3b9e8e8900d6010d77874ad396c67272a57d526db7d21887a90bcbdbe4
0588d2621f476d4941a35886ba99a3cbcfd2011eed2c1e4e9a5ff47e49b84b73
662c99fdb844c93db6fe5456e6e59f3eca80dbf092ced26e9256dc9e990f1455
4366aaaa7bf44ed9e1b3689574f32a8ed7cfc7cd5ebcf65b22478e9db5f91086
c3907ae9386019e97403c436ccd59a9486cfa62983dd9fda4c5a46fb0c19cf6f
42e4a419e9983ff24668de02908e95d3e4816c34e201811bc34d4b221dc11751
254bc968237a6e965cc06d4761818de91d9c8373a0d48a25d5b707081c975d75
SH256 hash:
c7255a752d27f04e242b5d3d56ee1c1c6a6c249b90e98a8bc835169875873df6
MD5 hash:
d84a2566b95e565ef3673e60fb68597d
SHA1 hash:
a73cbedafd9595eff7156c6c7690e0ceb6ae9cca
Detections:
win_doppeldridex_auto
Create hunting rule
Link:
https://www.unpac.me/results/11329582-0ba2-48f5-bd76-beb4899fd34a/
Parent samples :
ed8defd4e1e81fbc877f7419d6593303403504f4ea02de07085ea94d6ad78e18
6aece6407d065eb07920b284b3175a6153bba568041b2cab4bdfcb0873577ea6
SH256 hash:
ed8defd4e1e81fbc877f7419d6593303403504f4ea02de07085ea94d6ad78e18
MD5 hash:
2f664dacdb5ae1543d5d68415bb58bd5
SHA1 hash:
53cc0a4f5cf33f4dbf683da5bd27bcdeabbca4f8
Link:
https://www.unpac.me/results/11329582-0ba2-48f5-bd76-beb4899fd34a/
Malware family:
Dridex
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/ed8defd4e1e8/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/ed8defd4e1e81fbc877f7419d6593303403504f4ea02de07085ea94d6ad78e18

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Sectigo_Code_Signed
Create hunting rule
Description:Detects code signed by the Sectigo RSA Code Signing CA
Reference:https://bazaar.abuse.ch/export/csv/cscb/
Rule name:Sectigo_Code_Signed
Create hunting rule
Description:Detects code signed by the Sectigo RSA Code Signing CA
Reference:https://bazaar.abuse.ch/export/csv/cscb/

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Dridex

DLL dll ed8defd4e1e81fbc877f7419d6593303403504f4ea02de07085ea94d6ad78e18

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1806273/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/208362/

Comments