🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f46403b87fbf1cf29998b7a5675b8e45903c380ed3765bbf4157efe552d652f9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Dridex


Vendor detections: 11


Intelligence 11 IOCs YARA 8 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f46403b87fbf1cf29998b7a5675b8e45903c380ed3765bbf4157efe552d652f9
SHA3-384 hash: 6dc5571510e3aced0ebcc7521abf985a9a2cb41a299f61886407dccc3e1260ab8d7669357997f0fa75c1d2417d743dcd
SHA1 hash: bc9a789624f3094a1405e9c980b4a3bbcec1ce3e
MD5 hash: c2a168520d6da6b68809dc94edc61de2
humanhash: angel-two-tennessee-diet
File name:c2a168520d6da6b68809dc94edc61de2.dll
Download: download sample
Signature Dridex
Create hunting rule
File size:439'144 bytes
First seen:2021-11-22 18:50:31 UTC
Last seen:2021-11-22 20:55:37 UTC
File type:DLL dll
MIME type:application/x-dosexec
imphash 3f84747faed4a03ac4a29c71aec18674 (20 x Dridex)
ssdeep 12288:ypY+i26s0+yheTEuvIKRcUDoWdIcgTUEtHkIGixsCCo+pxM:yGtddZwrnzPDgQE6IGIsggxM
Threatray 5'444 similar samples on MalwareBazaar
TLSH T18394B04441876A71F65115F8BEDB3AF2BCB3CC7EF4E05E1D2208489B2F4F15640AA6B6
Reporter abuse_ch
Tags:dll Dridex signed

Code Signing Certificate

Organisation:STAND ALONE MUSIC LTD
Issuer:Sectigo RSA Code Signing CA
Algorithm:sha256WithRSAEncryption
Valid from:2020-12-07T00:00:00Z
Valid to:2021-12-07T23:59:59Z
Serial number: 3b777165b125bccc181d0bac3f5b55b3
Intelligence: 55 malware samples on MalwareBazaar are signed with this code signing certificate
MalwareBazaar Blocklist:This certificate is on the MalwareBazaar code signing certificate blocklist (CSCB)
Thumbprint Algorithm:SHA256
Thumbprint: f680fab6a9d21e8e76003c5c28b3c5084866d7ac85cf0cfb5aaa02f69ee99f1e
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin
# of uploads :
2
# of downloads :
133
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Detection(s):
SecuriteInfo.com.Trojan.Dridex.777.5766.26261.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
DNS request
Sending a custom TCP request
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
overlay packed
Link:
https://www.filescan.io/uploads/619be69bdd04e7d00e029a92/reports/55440a68-433d-45f5-8245-b23b73fe3629/overview
Malware family:
Dridex
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/4fa23e31-ebfa-486e-a735-e720e5145154
Result
Threat name:
Dridex
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
72 / 100
Link:
https://www.joesandbox.com/analysis/894140
Signature
C2 URLs / IPs found in malware configuration
Found malware configuration
Multi AV Scanner detection for submitted file
Tries to delay execution (extensive OutputDebugStringW loop)
Yara detected Dridex unpacked file
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 526618 Sample: T9XEpvkmJu.dll Startdate: 22/11/2021 Architecture: WINDOWS Score: 72 41 188.165.214.166 OVHFR France 2->41 43 67.207.95.35 DIGITALOCEAN-ASNUS United States 2->43 45 2 other IPs or domains 2->45 49 Found malware configuration 2->49 51 Multi AV Scanner detection for submitted file 2->51 53 Yara detected Dridex unpacked file 2->53 55 C2 URLs / IPs found in malware configuration 2->55 9 loaddll32.exe 1 2->9         started        signatures3 process4 process5 11 rundll32.exe 9->11         started        14 rundll32.exe 9->14         started        16 rundll32.exe 9->16         started        18 4 other processes 9->18 signatures6 57 Tries to delay execution (extensive OutputDebugStringW loop) 11->57 20 WerFault.exe 9 11->20         started        22 WerFault.exe 9 14->22         started        25 WerFault.exe 14->25         started        27 WerFault.exe 2 9 16->27         started        29 WerFault.exe 16->29         started        31 rundll32.exe 18->31         started        33 WerFault.exe 18->33         started        35 WerFault.exe 18->35         started        37 2 other processes 18->37 process7 dnsIp8 47 192.168.2.1 unknown unknown 22->47 39 WerFault.exe 23 9 31->39         started        process9
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f46403b87fbf1cf29998b7a5675b8e45903c380ed3765bbf4157efe552d652f9/
Threat name:
Win32.Trojan.Drixed
Create hunting rule
Status:
Malicious
First seen:
2021-11-22 18:51:12 UTC
File Type:
PE (Dll)
AV detection:
28 of 45 (62.22%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=6rsahod7x4opfgmyw6swow4oiwidyoao2n3fxp2bk7x6kuwwkl4q._file
Verdict:
malicious
Label(s):
doppeldridex
Create hunting rule
dridex
Create hunting rule
Similar samples:
2c54438f5d99d15e5df3965397e25a0fa17ca7f08d317eb4bf31d1268e10f020
Dridex
2dd54462c65a469a2611be091d84fa71a4c1b5b61d020f4058296153941d9e13
Dridex
cc31d1c3648d35d98c16d49ff17e290b07f431ccd23434b50c905c2aa4ba8f38
Dridex
ec705e006b4074a61b4b001660ce083e1948bb7ef17c69a90ad5ef5bb635d132
Dridex
ee1259ba7e41be5e8f11fb7ed2fb983bd9a48e757cf59690336aa63ac2497dba
Dridex
f4f0127923c4a1c69aab04516907fd4010f9af8302e132b972d053813577b18d
Dridex
ff277a5e33ec98ad5f0945834f731e39fa2113ac0369ade14fc690a9d1a7cc31
Dridex
+ 5'434 additional samples on MalwareBazaar
Result
Malware family:
dridex
Create hunting rule
Score:
  10/10
Tags:
family:dridex botnet:22203 botnet loader
Link:
https://tria.ge/reports/211122-xhg2esgfdm/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Dridex Loader
Dridex
Malware Config
C2 Extraction:
67.207.95.35:443
86.107.98.232:8333
188.165.214.166:4664
144.91.110.219:9217
Unpacked files
SH256 hash:
78c6a6e835d10c6eb61421e0d7a7df958dfab37974fa9b71c40cedfa09317be6
MD5 hash:
5e5c5a2ee5b77339ab395cf074d874a1
SHA1 hash:
d1a131933439404bf44fc6f494862745c9a4d213
Detections:
win_dridex_auto
Create hunting rule
Link:
https://www.unpac.me/results/83ea2496-9e27-4269-aae0-6b119322d9be/
Parent samples :
f46403b87fbf1cf29998b7a5675b8e45903c380ed3765bbf4157efe552d652f9
97b0ac9dc97eb0778dce6676ce9872ce8b621ee3d7e7c4e00c642d033d7dfbae
f03f91696ce0ddd77a4f220753ab3aa8c838d18b4f55824143a5071a9d32d1c0
ed8defd4e1e81fbc877f7419d6593303403504f4ea02de07085ea94d6ad78e18
6aece6407d065eb07920b284b3175a6153bba568041b2cab4bdfcb0873577ea6
061f776afbe47244a114d956480c3371112b36ae3efaa679a730f9de465695b2
e223980a1fd0ad2f6674019e1f65113c30df79896ae08606eebfa2bcd56e982e
9cc73deb20bce4f6ddb48e575925d7eb583a34cfefb5635f3eb68954b8f4c75d
9a63b8546df4310d75234a37dabecb0e231876f897207e62e36831d08c0e7ac6
c9245778a049dc7e57228e0846f00ede4a62d779102772b628ba733beb2d149c
0ab7fef04ca81bddf9b7a2b17e7219fcaf4ee62836d614acbe17292223c88e49
ef626b3e8d15c5fd15664bdda8701891bb19e4fb9e1b746e6cecad30020fd944
bb8481137fc9cc71e49c6a2aefb846091f1810ad9d17b71d64713cda7cb9d3a3
c1194b3b9e8e8900d6010d77874ad396c67272a57d526db7d21887a90bcbdbe4
0588d2621f476d4941a35886ba99a3cbcfd2011eed2c1e4e9a5ff47e49b84b73
662c99fdb844c93db6fe5456e6e59f3eca80dbf092ced26e9256dc9e990f1455
4366aaaa7bf44ed9e1b3689574f32a8ed7cfc7cd5ebcf65b22478e9db5f91086
c3907ae9386019e97403c436ccd59a9486cfa62983dd9fda4c5a46fb0c19cf6f
42e4a419e9983ff24668de02908e95d3e4816c34e201811bc34d4b221dc11751
254bc968237a6e965cc06d4761818de91d9c8373a0d48a25d5b707081c975d75
SH256 hash:
be73c5c639d2ac11cb0b3f363b4b03ba0948c429f177e1c13b8326471dd78492
MD5 hash:
92eb1f08659c2299d589628c55e6430a
SHA1 hash:
2ff013bb73cab1de7aea8e920be8ce4abe085ad6
Detections:
win_doppeldridex_auto
Create hunting rule
Link:
https://www.unpac.me/results/83ea2496-9e27-4269-aae0-6b119322d9be/
SH256 hash:
f46403b87fbf1cf29998b7a5675b8e45903c380ed3765bbf4157efe552d652f9
MD5 hash:
c2a168520d6da6b68809dc94edc61de2
SHA1 hash:
bc9a789624f3094a1405e9c980b4a3bbcec1ce3e
Link:
https://www.unpac.me/results/83ea2496-9e27-4269-aae0-6b119322d9be/
Malware family:
Dridex
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/f46403b87fbf/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/f46403b87fbf1cf29998b7a5675b8e45903c380ed3765bbf4157efe552d652f9

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DridexLoader
Create hunting rule
Author:kevoreilly
Description:Dridex v4 dropper C2 parsing function
Rule name:DridexV4
Create hunting rule
Author:kevoreilly
Description:Dridex v4 Payload
Rule name:dridex_loader
Create hunting rule
Author:kevoreilly
Description:Dridex Loader
Rule name:MALWARE_Win_DLLLoader
Create hunting rule
Author:ditekSHen
Description:Detects unknown DLL Loader
Rule name:Sectigo_Code_Signed
Create hunting rule
Description:Detects code signed by the Sectigo RSA Code Signing CA
Reference:https://bazaar.abuse.ch/export/csv/cscb/
Rule name:Sectigo_Code_Signed
Create hunting rule
Description:Detects code signed by the Sectigo RSA Code Signing CA
Reference:https://bazaar.abuse.ch/export/csv/cscb/
Rule name:win_doppeldridex_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.doppeldridex.
Rule name:win_dridex_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.dridex.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Dridex

DLL dll f46403b87fbf1cf29998b7a5675b8e45903c380ed3765bbf4157efe552d652f9

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1806151/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/208328/

Comments