MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f418e50acd39dd9daf5a6f7ef7e18be397ee1850854333c6865d3ea0b6030111. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Dridex


Vendor detections: 11


Intelligence 11 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f418e50acd39dd9daf5a6f7ef7e18be397ee1850854333c6865d3ea0b6030111
SHA3-384 hash: 605dcb6e4517ac9bbfbfcda48eb855df40a39dad494dead9c765128a4ba6bb2a1f3654e366f8e4a50fd3ca731b7adc1d
SHA1 hash: 76081e6e9a57885fb89988321c656d829d5c067a
MD5 hash: 0fcb138fb013fb6f6478300aa0bdae2c
humanhash: quiet-nevada-alanine-timing
File name:UpdateTool.exe
Download: download sample
Signature Dridex
Create hunting rule
File size:172'032 bytes
First seen:2021-07-08 18:40:37 UTC
Last seen:2021-07-08 19:52:12 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 31a0addec650b37a5ad474ece75fe3bc (2 x Dridex)
ssdeep 3072:dmCq1Gk7yBWmNvuJrUynnldI2PnqcYALsCSvn9QH1ugouIuCNZEc:dmCD49iynldfTLsJvn9QVuBruC
Threatray 4'569 similar samples on MalwareBazaar
TLSH T10CF3F101EB7F04E6C5C302B304A4513BFA14FC13A715CE5985F99A11ADAF7FBD82998A
Reporter Anonymous
Tags:Dridex exe


Avatar
Anonymous
E-mail subject: "Kaseya update information about incident xxxxxxx from response team."

Intelligence

File Origin
# of uploads :
2
# of downloads :
135
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
https://cdn.discordapp.com/attachments/862601612979208205/862601923516956692/UpdateTool.exe
Verdict:
Suspicious activity
Analysis date:
2021-07-08 15:18:14 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/5f3bd09f-2068-430d-8e13-88b2f8cefe2d

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
DridexLoader
Create hunting rule
Link:
https://www.capesandbox.com/analysis/170547/
Detection(s):
SecuriteInfo.com.W32.AIDetect.malware1.26841.15058.UNOFFICIAL
Create hunting rule

Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Dridex
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/f4a1f780-3557-4f55-b17a-8045157d2a4f
Result
Threat name:
Dridex
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/813698
Signature
C2 URLs / IPs found in malware configuration
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found malware configuration
Found potential dummy code loops (likely to delay analysis)
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Tries to delay execution (extensive OutputDebugStringW loop)
Tries to detect sandboxes / dynamic malware analysis system (file name check)
Tries to detect virtualization through RDTSC time measurements
Yara detected Dridex unpacked file
Behaviour
Behavior Graph:
Download SVG
Detection:
dridex
Create hunting rule
Link:
https://mwdb.cert.pl/sample/f418e50acd39dd9daf5a6f7ef7e18be397ee1850854333c6865d3ea0b6030111/
Threat name:
Win32.Trojan.Zenpak
Create hunting rule
Status:
Malicious
First seen:
2021-07-08 17:56:28 UTC
AV detection:
14 of 29 (48.28%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
doppeldridex
Create hunting rule
dridex
Create hunting rule
Similar samples:
0a691b51946c0c94cb5240779acb4586626b909e7630915a66600ceb81cb80b8
Dridex
17aeb7372b57d7559a6f507074fe1da973a104a2de8b0d8e229bfc4515c6d015
Dridex
1b3db260f69f51fd02533da364f56a4825e5ac0777ffc1fb68d54ce17662191e
Dridex
2ba11191a9da3d155b82d848577ee0b7eed0a90f86091d187bc157dd252a3d44
Dridex
60292d0e9ee95a94029fc83e6caebd7d8bbc694bef446d90519df743cbc45cfe
Dridex
72306c6457c918bfaa19009cc21ae5eaf4bfad936e8694482c719f6f1c0c0266
Dridex
764f41b29285d1ad19f7bc5f0ad5d34255951cda7e24462e80bfe45847dbd545
Dridex
7f61a019043d857722dc90a0f07d979c1cad3980b59b2497a3a9ced734e9a8d0
Dridex
97d62d9cba3d8219f27c42650eb90fd3ee8aa4c7f478c76e30f88f11dd5e1a82
Dridex
+ 4'559 additional samples on MalwareBazaar
Result
Malware family:
dridex
Create hunting rule
Score:
  10/10
Tags:
family:dridex botnet:22201 botnet evasion loader trojan
Link:
https://tria.ge/reports/210708-3r6ayjs6wx/
Behaviour
Checks whether UAC is enabled
Dridex Loader
Dridex
Malware Config
C2 Extraction:
164.68.126.207:23399
150.95.20.209:3978
107.170.211.239:4664
Unpacked files
SH256 hash:
f95b52bc4fa7daff645d06113f537e7e2c4508194f100de96ea8c9cc94e6adbb
MD5 hash:
5a4edb5b8729dc5de5b9076239aa8442
SHA1 hash:
0e3abd15927a9cc3f32205986e27a093505b79bb
Detections:
win_doppeldridex_auto
Create hunting rule
Link:
https://www.unpac.me/results/0d952cb5-1b71-435e-8878-dd2acea280e2/
SH256 hash:
f418e50acd39dd9daf5a6f7ef7e18be397ee1850854333c6865d3ea0b6030111
MD5 hash:
0fcb138fb013fb6f6478300aa0bdae2c
SHA1 hash:
76081e6e9a57885fb89988321c656d829d5c067a
Link:
https://www.unpac.me/results/0d952cb5-1b71-435e-8878-dd2acea280e2/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/f418e50acd39dd9daf5a6f7ef7e18be397ee1850854333c6865d3ea0b6030111

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DridexLoader
Create hunting rule
Author:kevoreilly
Description:Dridex v4 dropper C2 parsing function
Rule name:INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFuture
Create hunting rule
Author:ditekSHen
Description:Detect executables with stomped PE compilation timestamp that is greater than local current time
Rule name:win_doppeldridex_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.doppeldridex.
Rule name:win_nymaim_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.nymaim.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Distributed via e-mail link
Cape
Cape
https://www.capesandbox.com/analysis/170547/

Comments