🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f955eb8e8f51f4110ff60c52d8973c14e3360b60b3fc09f235fe5a8d8b292c14. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Dridex


Vendor detections: 10


Intelligence 10 IOCs YARA 6 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f955eb8e8f51f4110ff60c52d8973c14e3360b60b3fc09f235fe5a8d8b292c14
SHA3-384 hash: 0b3fc94b5c36932bac5f6981ce95e33c1f8a3d1fa9dbdd7d128033e867eaaf4b75576cedf0827ad67bdf6262120cc2c2
SHA1 hash: 3c0d90a7626048c1002bd6ab040a3d6c073b505a
MD5 hash: eb39371022df0d82eda54d23dffb91f7
humanhash: west-saturn-artist-massachusetts
File name:RbrKCqqjDPUwhoreniggagay.bin
Download: download sample
Signature Dridex
Create hunting rule
File size:630'784 bytes
First seen:2021-12-01 17:38:07 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash b40dcfaf70c38f9fb81094167afaac3d (3 x Dridex)
ssdeep 12288:0Ycs1Ck41CQW1CE21CAe1Ces1iYO1Cyg1aYkY1hg7zDTKfVyNX2uqKUuIa448qYV:Es1Ck41CQW1CE21CAe1Ces1iYO1Cyg1N
Threatray 5'484 similar samples on MalwareBazaar
TLSH T1A4D4BE4CBB5A0AD1F44A59FB6B197941BF371720F0D86FBE736018016932CA5AE9B10F
Reporter malwarelabnet
Tags:dll Dridex

Intelligence

File Origin
# of uploads :
1
# of downloads :
160
Origin country :
n/a
Vendor Threat Intelligence
Detection:
DridexV4
Create hunting rule
Link:
https://www.capesandbox.com/analysis/210426/
Result
Verdict:
Clean
Maliciousness:

Behaviour
Searching for the window
DNS request
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/61a7b33986bf67e7121dcbed/reports/86e647f6-52ea-4f8f-a87c-45adc2f2ea81/overview
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/72cc47b5-942a-480c-8aaa-dfacb0b4eed0
Result
Threat name:
Dridex
Create hunting rule
Detection:
malicious
Classification:
troj
Score:
68 / 100
Link:
https://www.joesandbox.com/analysis/899652
Signature
C2 URLs / IPs found in malware configuration
Found malware configuration
Multi AV Scanner detection for submitted file
Yara detected Dridex unpacked file
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 532126 Sample: RbrKCqqjDPUwhoreniggagay.bin Startdate: 01/12/2021 Architecture: WINDOWS Score: 68 21 185.4.135.165 TOPHOSTGR Greece 2->21 23 149.56.106.83 OVHFR Canada 2->23 25 3 other IPs or domains 2->25 27 Found malware configuration 2->27 29 Multi AV Scanner detection for submitted file 2->29 31 Yara detected Dridex unpacked file 2->31 33 C2 URLs / IPs found in malware configuration 2->33 9 loaddll32.exe 1 2->9         started        signatures3 process4 process5 11 cmd.exe 1 9->11         started        13 rundll32.exe 9->13         started        process6 15 rundll32.exe 11->15         started        17 WerFault.exe 9 13->17         started        process7 19 WerFault.exe 23 9 15->19         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f955eb8e8f51f4110ff60c52d8973c14e3360b60b3fc09f235fe5a8d8b292c14/
Threat name:
Win32.Infostealer.Dridex
Create hunting rule
Status:
Malicious
First seen:
2021-12-01 17:21:32 UTC
File Type:
PE (Dll)
AV detection:
23 of 28 (82.14%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=7fk6xdupkh2bcd7wbrjnrfz4ctrtmc3awp6at4rv7zni3czjfqka._file
Verdict:
malicious
Label(s):
doppeldridex
Create hunting rule
dridex
Create hunting rule
Similar samples:
2c54438f5d99d15e5df3965397e25a0fa17ca7f08d317eb4bf31d1268e10f020
Dridex
3cba24dba02d5817a029caee6eadf1b3b4eb75ff861c62df3e4d4fbde1c349c2
Dridex
537866a96449444a54002776f34eecf053c23122a554a79f4743df0749aa8005
Dridex
770cb2aa5ea76f90e27bc72110b531fa3985ab4352d25362926971285408f148
Dridex
ec705e006b4074a61b4b001660ce083e1948bb7ef17c69a90ad5ef5bb635d132
Dridex
ef08eafe517a3af06bb806865de42aac88231aac2e1462fa5b44b0db7231cf28
Dridex
f4f0127923c4a1c69aab04516907fd4010f9af8302e132b972d053813577b18d
Dridex
ff277a5e33ec98ad5f0945834f731e39fa2113ac0369ade14fc690a9d1a7cc31
Dridex
+ 5'474 additional samples on MalwareBazaar
Result
Malware family:
dridex
Create hunting rule
Score:
  10/10
Tags:
family:dridex botnet:22202 botnet loader
Link:
https://tria.ge/reports/211201-v7ss4sedhq/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Dridex Loader
Dridex
Malware Config
C2 Extraction:
149.56.106.83:443
45.79.248.254:2222
144.91.110.55:3978
94.177.217.88:808
185.4.135.165:5228
Unpacked files
SH256 hash:
6bef965808ebc9df4caeef91d565e470eaae725d55f01f2ee8fdcfd0d9f56b28
MD5 hash:
3324ee34ee06ff16a6d13f701fa8319f
SHA1 hash:
81cf3533eb0d296e7313193fb8d3978a5b1e3d5f
Detections:
win_doppeldridex_auto
Create hunting rule
Link:
https://www.unpac.me/results/b7bed8df-bb78-43d6-9a13-5aa8d2368421/
SH256 hash:
d34c16397a5656589bd47a0e37668b639f722782f6861c34039e29b8e9a7e097
MD5 hash:
fafb1db552d91c54e261cdef78068447
SHA1 hash:
e4db9fb3e8701746f7f585e4fa28193ee8bf4548
Detections:
win_dridex_auto
Create hunting rule
Link:
https://www.unpac.me/results/b7bed8df-bb78-43d6-9a13-5aa8d2368421/
Parent samples :
7fdba140289a63cb6789a60f690273571160c1270b6016d7c7598e1a914e036d
d3c9598f4123cb897b1d13e46c688c2548dba0eb832dc67511faaf6761f5743a
f955eb8e8f51f4110ff60c52d8973c14e3360b60b3fc09f235fe5a8d8b292c14
SH256 hash:
f955eb8e8f51f4110ff60c52d8973c14e3360b60b3fc09f235fe5a8d8b292c14
MD5 hash:
eb39371022df0d82eda54d23dffb91f7
SHA1 hash:
3c0d90a7626048c1002bd6ab040a3d6c073b505a
Link:
https://www.unpac.me/results/b7bed8df-bb78-43d6-9a13-5aa8d2368421/
Malware family:
Dridex
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/f955eb8e8f51/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/f955eb8e8f51f4110ff60c52d8973c14e3360b60b3fc09f235fe5a8d8b292c14

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DridexLoader
Create hunting rule
Author:kevoreilly
Description:Dridex v4 dropper C2 parsing function
Rule name:DridexV4
Create hunting rule
Author:kevoreilly
Description:Dridex v4 Payload
Rule name:dridex_loader
Create hunting rule
Author:kevoreilly
Description:Dridex Loader
Rule name:MALWARE_Win_DLLLoader
Create hunting rule
Author:ditekSHen
Description:Detects unknown DLL Loader
Rule name:win_doppeldridex_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.doppeldridex.
Rule name:win_dridex_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.dridex.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Dridex

DLL dll f955eb8e8f51f4110ff60c52d8973c14e3360b60b3fc09f235fe5a8d8b292c14

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1842263/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/210426/

Comments