🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ee1259ba7e41be5e8f11fb7ed2fb983bd9a48e757cf59690336aa63ac2497dba. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Dridex


Vendor detections: 9


Intelligence 9 IOCs YARA 6 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ee1259ba7e41be5e8f11fb7ed2fb983bd9a48e757cf59690336aa63ac2497dba
SHA3-384 hash: a4839839a4887fafb403de3dce4cf2dc79698d04c490351e3b651fbaba3b5b4de6c909a298f5ad96fe9912cc6c7e68fe
SHA1 hash: 32fd4277daaa3ac2095908562acff7459e3cd872
MD5 hash: 0247b0cb108b16d63646a1cf558141c1
humanhash: saturn-monkey-arkansas-michigan
File name:tWJVslCUpcEaUuDcuntfuck.mp4
Download: download sample
Signature Dridex
Create hunting rule
File size:438'272 bytes
First seen:2021-11-22 16:14:32 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash 8dec1a105645cd34f7153c99220eeea4 (17 x Dridex)
ssdeep 6144:2MaMQWTCJkdk5k7kBM7A9kkr+pt4PlaMEQ/j8I0r6BHAE7K4k:22maeqIGs+N4kMEyg6uEWp
Threatray 5'432 similar samples on MalwareBazaar
TLSH T1A8949F80F32B83E4DE09DE3B04FC985C153856E8FF5B16D5739C81FC35E49A898A6629
Reporter malwarelabnet
Tags:dll Dridex

Intelligence

File Origin
# of uploads :
1
# of downloads :
148
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Detection(s):
SecuriteInfo.com.W32.AIDetect.malware2.19056.9416.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Сreating synchronization primitives
DNS request
Sending a custom TCP request
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/619bc20a94a88037d2fea9c0/reports/fb01cc93-8ad8-449b-b42b-dfab638107b4/overview
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/fc1ee058-c04c-4334-bd9f-60eb528c6f39
Result
Threat name:
Dridex
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
72 / 100
Link:
https://www.joesandbox.com/analysis/894018
Signature
C2 URLs / IPs found in malware configuration
Found malware configuration
Multi AV Scanner detection for submitted file
Tries to delay execution (extensive OutputDebugStringW loop)
Yara detected Dridex unpacked file
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 526508 Sample: tWJVslCUpcEaUuDcuntfuck.mp4 Startdate: 22/11/2021 Architecture: WINDOWS Score: 72 40 188.165.214.166 OVHFR France 2->40 42 67.207.95.35 DIGITALOCEAN-ASNUS United States 2->42 44 2 other IPs or domains 2->44 46 Found malware configuration 2->46 48 Multi AV Scanner detection for submitted file 2->48 50 Yara detected Dridex unpacked file 2->50 52 C2 URLs / IPs found in malware configuration 2->52 9 loaddll32.exe 1 2->9         started        signatures3 process4 process5 11 rundll32.exe 9->11         started        14 rundll32.exe 9->14         started        16 rundll32.exe 9->16         started        18 4 other processes 9->18 signatures6 54 Tries to delay execution (extensive OutputDebugStringW loop) 11->54 20 WerFault.exe 9 11->20         started        22 WerFault.exe 2 9 14->22         started        24 WerFault.exe 14->24         started        26 WerFault.exe 16->26         started        28 WerFault.exe 16->28         started        30 rundll32.exe 18->30         started        32 WerFault.exe 9 18->32         started        34 WerFault.exe 18->34         started        36 WerFault.exe 18->36         started        process7 process8 38 WerFault.exe 23 9 30->38         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ee1259ba7e41be5e8f11fb7ed2fb983bd9a48e757cf59690336aa63ac2497dba/
Threat name:
Win32.Trojan.Drixed
Create hunting rule
Status:
Malicious
First seen:
2021-11-22 16:15:12 UTC
File Type:
PE (Dll)
AV detection:
31 of 45 (68.89%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=5yjftot6ig7f5dyr7n7nf64yhpm2jdtvpt2znebtnktdvqsjpw5a._file
Verdict:
malicious
Label(s):
doppeldridex
Create hunting rule
dridex
Create hunting rule
Similar samples:
2dd54462c65a469a2611be091d84fa71a4c1b5b61d020f4058296153941d9e13
Dridex
5998ba6bef4d61888a43213a75b78cdf13735906c5b9997f4d41958a513aed70
Dridex
6e1a19c1ead7999ac95c9a6ec469cedfdda7b513dee65cf6c3c7ebf9385eaffc
Dridex
7a64e750e4ffda0b1731bf0449d335d2e23d0b76bb3d66830f5fb740fdc0ca4a
Dridex
7ce57a5b519458ee81cbb394a3cd50cb8840620e5b0a2451b587ed651b69288b
Dridex
a51b5bab04a5b0f549dd27851e83550a47cd38abd109ee24bc1d96aae089d25c
Dridex
cc31d1c3648d35d98c16d49ff17e290b07f431ccd23434b50c905c2aa4ba8f38
Dridex
f2c2d92afa0f167bd54c763fc8fc3377bb6b9f1105b4bd0760c5a19018c41c3c
Dridex
fcdb7418de853985a97ec646304c172562701c5f34595eca6e5abe9dd1db66ca
Dridex
+ 5'422 additional samples on MalwareBazaar
Result
Malware family:
dridex
Create hunting rule
Score:
  10/10
Tags:
family:dridex botnet:22203 botnet loader
Link:
https://tria.ge/reports/211122-tp87psgaaq/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Dridex Loader
Dridex
Malware Config
C2 Extraction:
67.207.95.35:443
86.107.98.232:8333
188.165.214.166:4664
144.91.110.219:9217
Unpacked files
SH256 hash:
c9a4621fd7c05fd84cdb4381789f16aee72635f116a5d5cca98b9d89e4069a9b
MD5 hash:
25e08102352d83395dbceb0445cb88d8
SHA1 hash:
9994341a7280113e0a09fbcd503a359b112d40dd
Detections:
win_dridex_auto
Create hunting rule
Link:
https://www.unpac.me/results/22af0c13-bfc8-4c48-8b38-36e36878b53f/
Parent samples :
cc31d1c3648d35d98c16d49ff17e290b07f431ccd23434b50c905c2aa4ba8f38
2dd54462c65a469a2611be091d84fa71a4c1b5b61d020f4058296153941d9e13
ee1259ba7e41be5e8f11fb7ed2fb983bd9a48e757cf59690336aa63ac2497dba
92a5ea2c1f1cc5177f54568b6d6b878f46a2bd3e49daf93f6385d304dcc1ee40
ba5fb468274de91023a4b8d14ff5b79a5531fed3cc818cdc93969b5fdb1a309d
b169abddcc96b1c9b61cd112734ad9e1d13af76ac9eb33b12c00fec870ed322d
2db0e926b1d6d60ab8138c008be5cad1ee2dda7a2cbbd27496953a97464b7511
8cb564d0a6548b35d96707b24a90ec361d82098f25381257fb8300ee5d27c6dc
106cd82325eacb5a9eedef1a7e54a9ad4e982469abe0b54583fbd4b8a0bd35f2
553cce1f64c0364094da5b64103f5bf184559eb9a4f7ebc5e14897b89ab6eda1
887f1d15b4c5a13871220261516df2fdb3410ed7a8b6088deee0d38610cbe68a
5aab487dfb1bd8c811dcc0fa8c9c9e762bb8df69424fd585d60a4bba53664599
ddcaa1c7ba38d83e0f34da7cce150905cd0246f15334b9feadd8dcab5cd991ee
b1029b6074fcc508c36bfd3c9c1ec582da3650faae2a9af1eb867ad3e05fc513
5cb8c6baf6d41a0dd663d092ebb31ef7bdaa4370fb0f8cb6fd35b6a8744f31c9
be193b9e9d20df4110f8da469af38bb99f445a173b13d1941da6be8d8c81d1fd
5092d010953226e366db6d47af4bf9886179ea6eb2655f3e70d4a1a82af1c7d5
SH256 hash:
3cbfbee2d6b95076014d700cf981a3d3351e1d4fb12c17102fe6f73711f6d7f9
MD5 hash:
4dd55e3b7483eecf1c8cce831031b747
SHA1 hash:
d6d4ba3a19c23fe4f4bcf6fcd5900c467205c339
Detections:
win_doppeldridex_auto
Create hunting rule
Link:
https://www.unpac.me/results/22af0c13-bfc8-4c48-8b38-36e36878b53f/
Parent samples :
ee1259ba7e41be5e8f11fb7ed2fb983bd9a48e757cf59690336aa63ac2497dba
553cce1f64c0364094da5b64103f5bf184559eb9a4f7ebc5e14897b89ab6eda1
887f1d15b4c5a13871220261516df2fdb3410ed7a8b6088deee0d38610cbe68a
b1029b6074fcc508c36bfd3c9c1ec582da3650faae2a9af1eb867ad3e05fc513
SH256 hash:
ee1259ba7e41be5e8f11fb7ed2fb983bd9a48e757cf59690336aa63ac2497dba
MD5 hash:
0247b0cb108b16d63646a1cf558141c1
SHA1 hash:
32fd4277daaa3ac2095908562acff7459e3cd872
Link:
https://www.unpac.me/results/22af0c13-bfc8-4c48-8b38-36e36878b53f/
Malware family:
Dridex
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/ee1259ba7e41/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.14
Link:
https://yomi.yoroi.company/submissions/ee1259ba7e41be5e8f11fb7ed2fb983bd9a48e757cf59690336aa63ac2497dba

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DridexLoader
Create hunting rule
Author:kevoreilly
Description:Dridex v4 dropper C2 parsing function
Rule name:DridexV4
Create hunting rule
Author:kevoreilly
Description:Dridex v4 Payload
Rule name:dridex_loader
Create hunting rule
Author:kevoreilly
Description:Dridex Loader
Rule name:MALWARE_Win_DLLLoader
Create hunting rule
Author:ditekSHen
Description:Detects unknown DLL Loader
Rule name:win_doppeldridex_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.doppeldridex.
Rule name:win_dridex_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.dridex.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Dridex

DLL dll ee1259ba7e41be5e8f11fb7ed2fb983bd9a48e757cf59690336aa63ac2497dba

(this sample)

Cape
Cape
https://www.capesandbox.com/analysis/208273/
  
URLhaus
https://urlhaus.abuse.ch/url/1805843/
  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/1806192/

Comments