🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f68d1f0f0d98e40cd449b394d503d508f4933bbd513bf543579fb787a6a2c878. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Dridex


Vendor detections: 12


Intelligence 12 IOCs YARA 6 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f68d1f0f0d98e40cd449b394d503d508f4933bbd513bf543579fb787a6a2c878
SHA3-384 hash: e9e027bfa93c39008ed5ae2e326af6312d6f88c520f1bc89e5224479ca06ae99c51154176755b7019b1c260228310063
SHA1 hash: 40b17cf257ae66c1d4f26f2b0a86904d903f67a9
MD5 hash: 20a9ac804323cb3f25623e49ca3cef91
humanhash: black-pluto-eleven-four
File name:SecuriteInfo.com.W32.AIDetect.malware1.31779.4161
Download: download sample
Signature Dridex
Create hunting rule
File size:544'768 bytes
First seen:2021-12-22 18:05:53 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash e980d287af7ef0ccd616c6efb9daaae8 (19 x Dridex)
ssdeep 6144:qI+RYf/Mv1UvT4vjYf/Glpov3KvfMvLo+jwHk3UryzU3+R7ff4evm35IQku4+pMz:qIt2UAogoOwhx7nA4+pMKg
Threatray 5'744 similar samples on MalwareBazaar
TLSH T11EC4AE3E5F637898ECCC887A5928D0E893A5778388FC2BFAF154E853147582DB18DD64
Reporter SecuriteInfoCom
Tags:dll Dridex

Intelligence

File Origin
# of uploads :
1
# of downloads :
706
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.W32.AIDetect.malware1.31779.4161.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
DNS request
Sending a custom TCP request
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/61c3691d8991ba72b3925756/reports/1575f531-68b4-4976-83a1-21053ef6ec9a/overview
Malware family:
Dridex
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/7ee2590d-4e08-4667-bbc9-69cfd7d1e608
Result
Threat name:
Dridex
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
76 / 100
Link:
https://www.joesandbox.com/analysis/911669
Signature
C2 URLs / IPs found in malware configuration
Found malware configuration
Multi AV Scanner detection for submitted file
Sigma detected: Suspicious Call by Ordinal
Tries to delay execution (extensive OutputDebugStringW loop)
Yara detected Dridex unpacked file
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 544147 Sample: SecuriteInfo.com.W32.AIDete... Startdate: 22/12/2021 Architecture: WINDOWS Score: 76 18 185.4.135.27 TOPHOSTGR Greece 2->18 20 85.10.248.28 HETZNER-ASDE Germany 2->20 22 2 other IPs or domains 2->22 24 Found malware configuration 2->24 26 Multi AV Scanner detection for submitted file 2->26 28 Yara detected Dridex unpacked file 2->28 30 2 other signatures 2->30 9 loaddll32.exe 1 2->9         started        signatures3 process4 signatures5 32 Tries to delay execution (extensive OutputDebugStringW loop) 9->32 12 cmd.exe 1 9->12         started        process6 process7 14 rundll32.exe 12->14         started        process8 16 WerFault.exe 23 9 14->16         started       
Detection:
dridex
Create hunting rule
Link:
https://mwdb.cert.pl/sample/f68d1f0f0d98e40cd449b394d503d508f4933bbd513bf543579fb787a6a2c878/
Threat name:
Win32.Infostealer.Dridex
Create hunting rule
Status:
Malicious
First seen:
2021-12-22 18:06:16 UTC
File Type:
PE (Dll)
AV detection:
22 of 27 (81.48%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=62gr6dyntdsazvcjwoknka6vbd2jgo55ke57kq2xt63ypjvczb4a._file
Verdict:
malicious
Label(s):
doppeldridex
Create hunting rule
dridex
Create hunting rule
Similar samples:
42a44e52c0b4d3105ce3f46b7ce7bd30eb24c9b320823e1c25d7ca37f1cf32f8
Dridex
c4ee2acc6b5aca21235917972c19d30c5585662b59decc6994c54d51bf5d5b80
Dridex
e90c994527d5fff3e13ff2cc4e28c90cb7ed9fd1d1bfdc214074ca91c484d519
Dridex
edd5c9a776ab5864b62e9ee140d3474ee2fe4c46de591aa3a25bbd133a9f9fe8
Dridex
f2dd8226773272f9aa72fe62608175c2b46edb5d7b151e39d51bc6fe3512f50a
Dridex
+ 5'734 additional samples on MalwareBazaar
Result
Malware family:
dridex
Create hunting rule
Score:
  10/10
Tags:
family:dridex botnet:22201 botnet loader
Link:
https://tria.ge/reports/211222-wprc1afgg5/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Dridex Loader
Dridex
Malware Config
C2 Extraction:
144.91.122.102:443
85.10.248.28:593
185.4.135.27:5228
80.211.3.13:8116
Unpacked files
SH256 hash:
2b979a73c7b944e7fbb72289bd2288a1f55c94ecd548c15976ce1e9d6f52d66b
MD5 hash:
57a94463b3ca922ad2d492e2cb592bdc
SHA1 hash:
52efeb279a2017f5067546ee245f34a4383526d4
Detections:
win_doppeldridex_auto
Create hunting rule
Link:
https://www.unpac.me/results/5e426327-4254-44d3-8eff-370d78daa9ca/
SH256 hash:
852226c323edee15bdc0b7ea84dc9502c047a11b02af0aee032781aa512947c6
MD5 hash:
69573713c393260f02fc44e5b8e0c27b
SHA1 hash:
6bda8263774377ee0570310f6b5e97e30c2878a5
Detections:
win_dridex_auto
Create hunting rule
Link:
https://www.unpac.me/results/5e426327-4254-44d3-8eff-370d78daa9ca/
Parent samples :
edd5c9a776ab5864b62e9ee140d3474ee2fe4c46de591aa3a25bbd133a9f9fe8
07c08b4a043b8bc8bea97f36414ae42ade74a37c4d5542727fe6fb0644a48a71
a7efe0ee7f8d77a65b1fff3ba0cee76acb43223365dc348fa43ceecf93bcf7f0
60bd3eba4dac7d37cd07e375f4dbfe5e816b0ab599f28da31c5cf5b180b5849a
0e38ad126b9443e8b13fccbd199e74677800c8a83203f20d4161c1277c44c821
b06b7b05e576d19367c383aabd9c8fed8cd5e7955e2f1493d326b9b5306c7439
03ba158e40b1f9c80c0430cd9a06f00bcbddd3826a5965fccb4ac5b242b91a2c
f54781f5c41ce33227923791ecfd591cb0cbfd446d0d537ca5b2e9477cbf6da3
de171138107af68993856781363643f96bbfa0fc996b89f0cddb08e0b848cfde
77f2ef5318c1769a56e255466a3c7f67ab1c685b40b83a6e1a5303535c098a86
04314613785677f2790e60074119f36d5744df93941c32a5ed37d6b4f577d6f9
215dcfed2662b6c7271ccc2f9b3310dced8f3ffff6ce81c35e3ace792212e152
36a7ba45e945a04424bc1cde56afe70e748bab42bcf53ed459dd6f73bc3ce010
05a16b81c00f57c0bf4ec43f50759006fef117093bc68565c97525374223ff4f
7016f8f68d5288beb0d918f6de14d5aea2e0e7c8881850b9c5d8b688309edc0e
f68d1f0f0d98e40cd449b394d503d508f4933bbd513bf543579fb787a6a2c878
f546f0754cd26d16a43c495fb875760048fb227d9343b7e699befdfea7918547
d0275ec5e9ecaa584f4834bf4882853bfa5b806f684635388b429dc1487d1ae1
a1653f99e47125596487d61c3c66d5d865ba3f0991203203660f51da24cf0f4a
SH256 hash:
f68d1f0f0d98e40cd449b394d503d508f4933bbd513bf543579fb787a6a2c878
MD5 hash:
20a9ac804323cb3f25623e49ca3cef91
SHA1 hash:
40b17cf257ae66c1d4f26f2b0a86904d903f67a9
Link:
https://www.unpac.me/results/5e426327-4254-44d3-8eff-370d78daa9ca/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.96
Link:
https://yomi.yoroi.company/submissions/f68d1f0f0d98e40cd449b394d503d508f4933bbd513bf543579fb787a6a2c878

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DridexLoader
Create hunting rule
Author:kevoreilly
Description:Dridex v4 dropper C2 parsing function
Rule name:DridexV4
Create hunting rule
Author:kevoreilly
Description:Dridex v4 Payload
Rule name:dridex_loader
Create hunting rule
Author:kevoreilly
Description:Dridex Loader
Rule name:MALWARE_Win_DLLLoader
Create hunting rule
Author:ditekSHen
Description:Detects unknown DLL Loader
Rule name:win_doppeldridex_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.doppeldridex.
Rule name:win_dridex_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.dridex.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Dridex

DLL dll f68d1f0f0d98e40cd449b394d503d508f4933bbd513bf543579fb787a6a2c878

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1910942/
  
Delivery method
Distributed via web download

Comments