MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ff59f0cfc113ec9637aad80512fa7da4a2e77a0ac6ee26a055d73f00607d3217. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Dridex


Vendor detections: 10


Intelligence 10 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ff59f0cfc113ec9637aad80512fa7da4a2e77a0ac6ee26a055d73f00607d3217
SHA3-384 hash: 0273d111144330054d970bc39e0dd22e935b77c795b4fd59ff96f167a952648cafdce51e13ec16e268c61d8c0a4e5b31
SHA1 hash: 6636980477f8bb085b48b09775de78f97d7c19c0
MD5 hash: 16a8f6b9d308d5afa11260967e6553a5
humanhash: delaware-kilo-nine-maryland
File name:update.exe
Download: download sample
Signature Dridex
Create hunting rule
File size:172'032 bytes
First seen:2021-07-08 18:41:11 UTC
Last seen:2021-07-08 19:52:12 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 31a0addec650b37a5ad474ece75fe3bc (2 x Dridex)
ssdeep 3072:qmCq1Gk7yBWmNvuJrUynnldI29nqAYALsCSvn9QH1ugouIuCNZEb:qmCD49iynldfhLsJvn9QVuBruC
Threatray 4'572 similar samples on MalwareBazaar
TLSH T18DF3F101EB7F04E6C5C302B304E4513BFA14FC13A715CE5985F99A11ADAB7FBD82998A
Reporter Anonymous
Tags:Dridex exe


Avatar
Anonymous
E-mail subject: "Kaseya update information about incident xxxxxxx from response team."

Intelligence

File Origin
# of uploads :
2
# of downloads :
143
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
update.exe
Verdict:
No threats detected
Analysis date:
2021-07-08 18:47:51 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/809db5f9-90db-46b3-bede-7e39842bafc0

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
DridexLoader
Create hunting rule
Link:
https://www.capesandbox.com/analysis/170540/
Detection(s):
SecuriteInfo.com.W32.AIDetect.malware1.32104.26020.UNOFFICIAL
Create hunting rule

Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Dridex
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/3fea6d71-e036-4442-988f-3da84daf7803
Result
Threat name:
Dridex
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/813701
Signature
C2 URLs / IPs found in malware configuration
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found malware configuration
Found potential dummy code loops (likely to delay analysis)
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Tries to delay execution (extensive OutputDebugStringW loop)
Tries to detect sandboxes / dynamic malware analysis system (file name check)
Tries to detect virtualization through RDTSC time measurements
Yara detected Dridex unpacked file
Behaviour
Behavior Graph:
Download SVG
Detection:
dridex
Create hunting rule
Link:
https://mwdb.cert.pl/sample/ff59f0cfc113ec9637aad80512fa7da4a2e77a0ac6ee26a055d73f00607d3217/
Threat name:
Win32.Trojan.Zenpak
Create hunting rule
Status:
Malicious
First seen:
2021-07-08 18:30:16 UTC
AV detection:
14 of 29 (48.28%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
doppeldridex
Create hunting rule
dridex
Create hunting rule
Similar samples:
0a691b51946c0c94cb5240779acb4586626b909e7630915a66600ceb81cb80b8
Dridex
17aeb7372b57d7559a6f507074fe1da973a104a2de8b0d8e229bfc4515c6d015
Dridex
1b3db260f69f51fd02533da364f56a4825e5ac0777ffc1fb68d54ce17662191e
Dridex
2ba11191a9da3d155b82d848577ee0b7eed0a90f86091d187bc157dd252a3d44
Dridex
60292d0e9ee95a94029fc83e6caebd7d8bbc694bef446d90519df743cbc45cfe
Dridex
72306c6457c918bfaa19009cc21ae5eaf4bfad936e8694482c719f6f1c0c0266
Dridex
764f41b29285d1ad19f7bc5f0ad5d34255951cda7e24462e80bfe45847dbd545
Dridex
7f61a019043d857722dc90a0f07d979c1cad3980b59b2497a3a9ced734e9a8d0
Dridex
f418e50acd39dd9daf5a6f7ef7e18be397ee1850854333c6865d3ea0b6030111
Dridex
+ 4'562 additional samples on MalwareBazaar
Result
Malware family:
dridex
Create hunting rule
Score:
  10/10
Tags:
family:dridex botnet:22201 botnet evasion loader trojan
Link:
https://tria.ge/reports/210708-vwbfg4gr22/
Behaviour
Checks whether UAC is enabled
Dridex Loader
Dridex
Malware Config
C2 Extraction:
164.68.126.207:23399
150.95.20.209:3978
107.170.211.239:4664
Unpacked files
SH256 hash:
a4787ba4f13df31e4aa28edb22b2fcaef12f50cfd924321f1c47cc811c43596d
MD5 hash:
38473f1963f1499445f9b7b71d015db6
SHA1 hash:
68028d0d456479eb7e94884b669dd906eb1be5cb
Detections:
win_doppeldridex_auto
Create hunting rule
Link:
https://www.unpac.me/results/97eec434-294c-47f2-b1e5-a0c35c256a65/
SH256 hash:
ff59f0cfc113ec9637aad80512fa7da4a2e77a0ac6ee26a055d73f00607d3217
MD5 hash:
16a8f6b9d308d5afa11260967e6553a5
SHA1 hash:
6636980477f8bb085b48b09775de78f97d7c19c0
Link:
https://www.unpac.me/results/97eec434-294c-47f2-b1e5-a0c35c256a65/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/ff59f0cfc113ec9637aad80512fa7da4a2e77a0ac6ee26a055d73f00607d3217

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DridexLoader
Create hunting rule
Author:kevoreilly
Description:Dridex v4 dropper C2 parsing function

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Distributed via e-mail link
Cape
Cape
https://www.capesandbox.com/analysis/170540/

Comments