🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f1668c85b555e2c76538cbdd30418ccb6b29dc070456eee6bbfb14c55ba2244c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Dridex


Vendor detections: 11


Intelligence 11 IOCs YARA 6 File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f1668c85b555e2c76538cbdd30418ccb6b29dc070456eee6bbfb14c55ba2244c
SHA3-384 hash: 9f7560874667160fdc1b880f168c8ef9d22f92e553464302ff3d3554167f94810f7e4c8cf192e4cabf6fcf1690409784
SHA1 hash: 8f89b9c2be39f8a3cc95fbafdfbd3f8e777625bd
MD5 hash: e3f9210a7ba3403b0e386f0c5c25e623
humanhash: hawaii-louisiana-seventeen-ack
File name:e3f9210a7ba3403b0e386f0c5c25e623
Download: download sample
Signature Dridex
Create hunting rule
File size:663'552 bytes
First seen:2021-11-18 15:27:31 UTC
Last seen:2021-11-18 18:14:09 UTC
File type:DLL dll
MIME type:application/x-dosexec
imphash fe16443ce39f2fcea9c5accdb27a9eac (21 x Dridex)
ssdeep 12288:xLTlJzJzJBJZn/JH3lJxJLJZJdPgA1VKBUA1rlldXJw:xLJtpDv/lVbdT3IA1wBUA1rlldXK
Threatray 5'373 similar samples on MalwareBazaar
TLSH T1F9E48E0250D512FCFA898ABF155A67C1C6B310824ED1CB9E25CD07EADF64A03EE6D1B7
Reporter zbetcheckin
Tags:32 dll Dridex exe

Intelligence

File Origin
# of uploads :
3
# of downloads :
148
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Detection(s):
SecuriteInfo.com.Variant.Lazy.17111.15095.27879.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Сreating synchronization primitives
Sending a custom TCP request
DNS request
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
67%
Tags:
cridex dridex packed
Link:
https://www.filescan.io/uploads/619671052695a62af9f3197a/reports/9c4acf2b-a6c1-45ff-8b8b-9bdd195d25d6/overview
Malware family:
Dridex
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/6b131037-7de5-414c-aae3-8e03aff1f9e6
Result
Threat name:
Dridex
Create hunting rule
Detection:
malicious
Classification:
troj
Score:
72 / 100
Link:
https://www.joesandbox.com/analysis/892056
Signature
C2 URLs / IPs found in malware configuration
Found malware configuration
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Yara detected Dridex unpacked file
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 524529 Sample: 5gl3rljxWf Startdate: 18/11/2021 Architecture: WINDOWS Score: 72 18 54.37.70.105 OVHFR France 2->18 20 142.93.218.86 DIGITALOCEAN-ASNUS United States 2->20 22 2 other IPs or domains 2->22 26 Found malware configuration 2->26 28 Multi AV Scanner detection for submitted file 2->28 30 Yara detected Dridex unpacked file 2->30 32 2 other signatures 2->32 9 loaddll32.exe 1 2->9         started        signatures3 process4 process5 11 cmd.exe 1 9->11         started        process6 13 rundll32.exe 11->13         started        process7 15 WerFault.exe 23 9 13->15         started        dnsIp8 24 192.168.2.1 unknown unknown 15->24
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f1668c85b555e2c76538cbdd30418ccb6b29dc070456eee6bbfb14c55ba2244c/
Threat name:
Win32.Trojan.Drixed
Create hunting rule
Status:
Malicious
First seen:
2021-11-18 08:24:00 UTC
AV detection:
21 of 28 (75.00%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=6ftizbnvkxrmozjyzpotaqmmznvstxaharlo5zv37mkmkw5cerga._file
Verdict:
malicious
Label(s):
doppeldridex
Create hunting rule
dridex
Create hunting rule
Similar samples:
233abb27be4c337cf8b9999c58b73e5890a61741c896e3afe8794b13d5652eb5
Dridex
2bf87021745923bb669cc6eda22bb54b5249f74f7e7e8a04ebc4f16b01a0a8c4
Dridex
2c74a51c3843ccb411702e116ee7bf7c9efa3d53cbaf3709e789a6305a8ac67f
Dridex
32f0692da6367489eafc71602a1b075e177621e366101241206958a68318cf64
Dridex
33df285d24bac325fa5c56a08462a3ebf34904e4489abe7e6854f3f993ac033f
Dridex
832cd5a0d475e0309f03bd6a00ae888e0be1c6a8585f9175e0dbe41d3fc960a6
Dridex
8536dd733f30a414cb8040e2d15631e1124942b150c75a2ef9178e61d2a75689
Dridex
85dd0bbdc1dde143ffd3906d04ce15fa415b0f66abfaeb1f3476007c5664438e
Dridex
a3abf81a46e3e318450f496e08d8cd0c9952f43deb4c481e19f9cfd36e884f2a
Dridex
f81dcc275ffa54a53ed99e79aac49e274b1ce833b5c0c2fcfcb80a33da6e0408
Dridex
+ 5'363 additional samples on MalwareBazaar
Result
Malware family:
dridex
Create hunting rule
Score:
  10/10
Tags:
family:dridex botnet:22203 botnet loader
Link:
https://tria.ge/reports/211118-swclmsedaq/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Dridex Loader
Dridex
Malware Config
C2 Extraction:
54.37.70.105:443
198.199.70.22:6602
164.68.99.3:5007
142.93.218.86:4664
Unpacked files
SH256 hash:
51cd3f61eb91de7a0bdca4e1df861ce74ef439af7d1083bf00623567b7b47b5d
MD5 hash:
c584e03373197c76b52b49b951a417a6
SHA1 hash:
b6efe69668a89e3e977d3016b8606fdd06ec3cf2
Detections:
win_doppeldridex_auto
Create hunting rule
Link:
https://www.unpac.me/results/104a4ef9-deb3-4a06-9356-403b41823737/
SH256 hash:
2e4da7dbe3d43e07cf011302db7302f7b8d632d6823966ee620ae30cf34662e7
MD5 hash:
fffeb707e430160c6d8914689e04389b
SHA1 hash:
5537b9332c0efbfae10f9b433bb851959bd11cc7
Detections:
win_dridex_auto
Create hunting rule
Link:
https://www.unpac.me/results/104a4ef9-deb3-4a06-9356-403b41823737/
Parent samples :
8536dd733f30a414cb8040e2d15631e1124942b150c75a2ef9178e61d2a75689
32f0692da6367489eafc71602a1b075e177621e366101241206958a68318cf64
33df285d24bac325fa5c56a08462a3ebf34904e4489abe7e6854f3f993ac033f
a3abf81a46e3e318450f496e08d8cd0c9952f43deb4c481e19f9cfd36e884f2a
2bf87021745923bb669cc6eda22bb54b5249f74f7e7e8a04ebc4f16b01a0a8c4
85dd0bbdc1dde143ffd3906d04ce15fa415b0f66abfaeb1f3476007c5664438e
832cd5a0d475e0309f03bd6a00ae888e0be1c6a8585f9175e0dbe41d3fc960a6
233abb27be4c337cf8b9999c58b73e5890a61741c896e3afe8794b13d5652eb5
2c74a51c3843ccb411702e116ee7bf7c9efa3d53cbaf3709e789a6305a8ac67f
f81dcc275ffa54a53ed99e79aac49e274b1ce833b5c0c2fcfcb80a33da6e0408
b856b7bf0644dedaadccdc0c6b6c17edffb8d82abfac2db29e6107ecb8ae2912
be3eb491dd9953d6d06879a99357613f2a837f8a79a2ac3b67dfe7e6ce2bfdec
ad0a37a84fe23aa26337b1519c1208f5b2ada3d0ce4e0a6cbcceedf84f1222dc
d45df1bb669ebf3995005dd8e0c4a6999a776501cbca500182024b763b71cc1e
87ec152bfeda4a61988a9ade1dd1f45e2f39e7030b584be83de9da95d53a299e
6f2cb590bad8c42912576399c30686ffe95d28aee7adc9d0507335bb3d7e5824
dd8ac82effcb27eda36f0792d7ff5d50c66bca2c20386c5dd25565970f8234c2
c06e84c106ca78b1189aa03a7269ea76efd7879e3ef28a78ef9dcd5303328411
f1668c85b555e2c76538cbdd30418ccb6b29dc070456eee6bbfb14c55ba2244c
289bbd7c84e632bd35795623e60e1aea165eb25ebd20a6d979b7f01cf43eb0fd
7abfd89f20fc6b4d28c95fd22a977fbc247438071fdb6710fe24487d571c3314
SH256 hash:
f1668c85b555e2c76538cbdd30418ccb6b29dc070456eee6bbfb14c55ba2244c
MD5 hash:
e3f9210a7ba3403b0e386f0c5c25e623
SHA1 hash:
8f89b9c2be39f8a3cc95fbafdfbd3f8e777625bd
Link:
https://www.unpac.me/results/104a4ef9-deb3-4a06-9356-403b41823737/
Malware family:
Dridex
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/f1668c85b555/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Dridex
Score:
0.90
Link:
https://yomi.yoroi.company/submissions/f1668c85b555e2c76538cbdd30418ccb6b29dc070456eee6bbfb14c55ba2244c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DridexLoader
Create hunting rule
Author:kevoreilly
Description:Dridex v4 dropper C2 parsing function
Rule name:DridexV4
Create hunting rule
Author:kevoreilly
Description:Dridex v4 Payload
Rule name:dridex_loader
Create hunting rule
Author:kevoreilly
Description:Dridex Loader
Rule name:MALWARE_Win_DLLLoader
Create hunting rule
Author:ditekSHen
Description:Detects unknown DLL Loader
Rule name:win_doppeldridex_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.doppeldridex.
Rule name:win_dridex_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.dridex.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Dridex

DLL dll f1668c85b555e2c76538cbdd30418ccb6b29dc070456eee6bbfb14c55ba2244c

(this sample)

  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/1799614/
Cape
Cape
https://www.capesandbox.com/analysis/207293/

Comments


Avatar
zbet commented on 2021-11-18 15:27:34 UTC

url : hxxps://0gzblg.db.files.1drv.com/y4mNPerbRII2YMQPfzaoF_opAu2HmM1F_D-6aidw4ClqcXpyFFTco-8oQqsromQp0JwdKsJB46-aNqKlCtyAec21ZUEYcLsf5lfdvy7cEwSo3Gi_22W0x_nDIEVmB4ADE0ZK9B0AUFQoyuvgs9L86ugQz4TzrEkTogiA5PoskjVOLAEQZ4tIMIcORZhe0xGCDCc0o_w66-QLdVf__57LKKr6w/vdjsbroacc.mp4