🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ff897c52402c287c5a895d4626ef9b4f6bdd5b125723d2db7db48b1a43cd2bb0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Dridex


Vendor detections: 12


Intelligence 12 IOCs YARA File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ff897c52402c287c5a895d4626ef9b4f6bdd5b125723d2db7db48b1a43cd2bb0
SHA3-384 hash: ed4b962c7c0022567ae89c952b505508d4a143d65e4bb84a4542dcbab0a4c99535f090a8fba4e7daa21103202b09dc59
SHA1 hash: 6bb92726ff3fdec9a5484ac266803a927da420e5
MD5 hash: 7b213d794b67e1afd970f5ad6b01b1b6
humanhash: hydrogen-stream-mango-fourteen
File name:7b213d794b67e1afd970f5ad6b01b1b6
Download: download sample
Signature Dridex
Create hunting rule
File size:630'784 bytes
First seen:2021-12-04 13:18:30 UTC
Last seen:2021-12-04 15:17:22 UTC
File type:DLL dll
MIME type:application/x-dosexec
imphash a8216198551e5fea52de18ae98283824 (33 x Dridex)
ssdeep 12288:dZENU3sDifTQzSb4rRrV6dVk/VQ/VE/VF5CiiN5Pulv2c7eaciuSaU:dWOc+U+kNh6rkdQdEdF5NiN5g7eaciuJ
Threatray 5'539 similar samples on MalwareBazaar
TLSH T134D48E2C740E2119F41A387A3B1A71F3FBE63EE065AFD8678E8424F22F466E145B4175
Reporter zbetcheckin
Tags:32 dll Dridex exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
255
Origin country :
n/a
Vendor Threat Intelligence
Detection:
DridexV4
Create hunting rule
Link:
https://www.capesandbox.com/analysis/211303/
Detection(s):
SecuriteInfo.com.Trojan.Dridex.827.29826.2620.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
DNS request
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
67%
Tags:
cridex dridex packed zusy
Link:
https://www.filescan.io/uploads/61ab6ac84d8e6f3a5e0f9db7/reports/07f51bed-37ab-44c6-9d76-23a6213cd423/overview
Malware family:
Dridex
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/b79ec201-765f-43c2-a42e-a238655ba846
Result
Threat name:
Dridex
Create hunting rule
Detection:
malicious
Classification:
troj
Score:
72 / 100
Link:
https://www.joesandbox.com/analysis/901416
Signature
C2 URLs / IPs found in malware configuration
Found malware configuration
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Yara detected Dridex unpacked file
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 533894 Sample: IgTn0ecD4R Startdate: 04/12/2021 Architecture: WINDOWS Score: 72 21 185.4.135.165 TOPHOSTGR Greece 2->21 23 149.56.106.83 OVHFR Canada 2->23 25 3 other IPs or domains 2->25 27 Found malware configuration 2->27 29 Multi AV Scanner detection for submitted file 2->29 31 Yara detected Dridex unpacked file 2->31 33 2 other signatures 2->33 9 loaddll32.exe 1 2->9         started        signatures3 process4 process5 11 cmd.exe 1 9->11         started        13 rundll32.exe 9->13         started        process6 15 rundll32.exe 11->15         started        17 WerFault.exe 9 13->17         started        process7 19 WerFault.exe 23 9 15->19         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ff897c52402c287c5a895d4626ef9b4f6bdd5b125723d2db7db48b1a43cd2bb0/
Threat name:
Win32.Trojan.Drixed
Create hunting rule
Status:
Malicious
First seen:
2021-12-02 02:31:00 UTC
File Type:
PE (Dll)
AV detection:
31 of 45 (68.89%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=76exyusafquhywujlvdcn343j5v52wysk4r5fw35wsfruq6nfoya._file
Verdict:
malicious
Label(s):
doppeldridex
Create hunting rule
dridex
Create hunting rule
Similar samples:
3f93bbbd31f1ca5627326b08e3fdffeed857a43e0800fb2e0503065adf42be30
Dridex
583de1b712e2bbbfd876553c385129f316bbfa46c0033b07d886a076bb3a3553
Dridex
5def0b736bef3857c2b741e5fa0a4f179736a1d8d1fc3941d6707a6807381763
Dridex
84f37808396aa0fb587bac76d4322a27532c8ca5fb9a7c76492ea84d162e3310
Dridex
99e042854717f6de443e055534c7513b106f7904f320afc5385660a50e7a61ff
Dridex
+ 5'529 additional samples on MalwareBazaar
Result
Malware family:
dridex
Create hunting rule
Score:
  10/10
Tags:
family:dridex botnet:22201 botnet loader
Link:
https://tria.ge/reports/211204-qkhx6sdgd3/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Dridex Loader
Dridex
Malware Config
C2 Extraction:
149.56.106.83:443
45.79.248.254:2222
144.91.110.55:3978
94.177.217.88:808
185.4.135.165:5228
Unpacked files
SH256 hash:
aa2c29d94a3d3b6549feb232c74712ad39163599efc9932c4daab57d0fd9922b
MD5 hash:
91238674af8664eb68b35ec21d3b0673
SHA1 hash:
bf3ea11bffaab4804ec40f9492fe022148814297
Detections:
win_dridex_auto
Create hunting rule
Link:
https://www.unpac.me/results/e6cf2c30-c87d-432f-b90e-741e35d45aeb/
Parent samples :
b61f624589d5ad3584e09f3174f8e3e1ac38958f260eee526b0abaf7389d7932
99e042854717f6de443e055534c7513b106f7904f320afc5385660a50e7a61ff
aef59db50378667cff8b3181421445c59a27932d835d47f016a879ced1f04dd7
5def0b736bef3857c2b741e5fa0a4f179736a1d8d1fc3941d6707a6807381763
12fe5d80d324fde6ef3235b1054f24356bccf8f72a7b79b555dac06b97342403
d2c0aec06c46b34adf7d3ef03a429ba9d002775e851e59e74cc64f413d695dec
5e4474540d6a18cc234d6c831514de5e027fa2907595ec4f22a0399eb492f88b
63be890e8b157de3ae4dca164818c94d823e777b40de79fea99f3177a5533ee9
2331c1ea9b61002e8f00e678780de6be847e638ebd28bab6f045c3fbe9984a14
84d95cbc8969a22550309b3eb3633b78d48b29ca4d825314056f0e66823739cc
5de057704e2a85cfff7e44ad451325c7e56cdf11a43fd0a1432a8f7a650b054b
583de1b712e2bbbfd876553c385129f316bbfa46c0033b07d886a076bb3a3553
3f93bbbd31f1ca5627326b08e3fdffeed857a43e0800fb2e0503065adf42be30
84f37808396aa0fb587bac76d4322a27532c8ca5fb9a7c76492ea84d162e3310
1d29ecde092f21ea0dd05b9f42531be1ed2207d6ebb9b463517f4c9508ff24a7
b7b3714d0714371522f28baf997ae78c34c8980d7b77a6600924719c4b2b037f
28d50aa5fc2ee8f16cc698d816c64ef79ed9d98587ae6816539e897773414024
87d2c1489a831b10ed176efb8a1bb73657418e4f332d6de0e10fa0f21c71fa11
b9d822c23278d5546fb225ac08f5a72231248ef27c38242f06f0495940790481
548a04fdd00a3327c6423736783d260c34ded9aa47c3c4abc29df2a128aa1b74
5fab3822f3842905d42d1b14a0c0f67336e40cf789393e3d59b8a68bf9f19feb
65858cba029d03cff70d8b54050523a1cd8b8b0f7cabfbd631944349d7b4a8cd
4b5065bfdc821c77eae5d00c1f526cde579eb5688649baa48931a6879565571a
ad4637ebab9999270e5ea2c82695c3abde792a54a2e7fd5b990ded043620049e
e3dc89c3cbb368c868c5332e768a6ccac0444d3e5f077790aac31f88691b9509
f0dd04098975f1c5de71209f9a7233295eee2cc30804fbbbcdc1dbc9bc00abb5
1ca9365813fc56e27b3a2fad0a6abc8268252593a89b3d8d9d699e6042f33fdf
9997b58e5e99a5f016f637d17b183f82e769d25484fb07aa6ec4cc102e42e6e0
10c879702701823effd064a5a7fa817010b404c40625b146778f309269bfd157
64a15ab0a90083db4b995d933d3897b3523f1893530c2ecea7e78977ff03ccd2
ff897c52402c287c5a895d4626ef9b4f6bdd5b125723d2db7db48b1a43cd2bb0
5e105744ba049ea2e8395b2059b8339f3b98af884c0d9c3e1496601c5d1bf93b
34990ad80292142c3cf0706eef7b76697fa17c684064085c5d166b8bc292618d
SH256 hash:
d9ccd5dadb98a991c5ce3cfcb98d512a5a0569b77187ff443c1c046f3ffd5cea
MD5 hash:
9d965dac46843b98766aeab31ac031ef
SHA1 hash:
b7484628c224c8c57cd4062901f6a7424335d401
Detections:
win_doppeldridex_auto
Create hunting rule
Link:
https://www.unpac.me/results/e6cf2c30-c87d-432f-b90e-741e35d45aeb/
Parent samples :
b61f624589d5ad3584e09f3174f8e3e1ac38958f260eee526b0abaf7389d7932
4b5065bfdc821c77eae5d00c1f526cde579eb5688649baa48931a6879565571a
9997b58e5e99a5f016f637d17b183f82e769d25484fb07aa6ec4cc102e42e6e0
ff897c52402c287c5a895d4626ef9b4f6bdd5b125723d2db7db48b1a43cd2bb0
SH256 hash:
ff897c52402c287c5a895d4626ef9b4f6bdd5b125723d2db7db48b1a43cd2bb0
MD5 hash:
7b213d794b67e1afd970f5ad6b01b1b6
SHA1 hash:
6bb92726ff3fdec9a5484ac266803a927da420e5
Link:
https://www.unpac.me/results/e6cf2c30-c87d-432f-b90e-741e35d45aeb/
Malware family:
Dridex
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/ff897c52402c/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/ff897c52402c287c5a895d4626ef9b4f6bdd5b125723d2db7db48b1a43cd2bb0

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Dridex

DLL dll ff897c52402c287c5a895d4626ef9b4f6bdd5b125723d2db7db48b1a43cd2bb0

(this sample)

  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/1851757/
Cape
Cape
https://www.capesandbox.com/analysis/211303/

Comments


Avatar
zbet commented on 2021-12-04 13:18:32 UTC

url : hxxp://fire.hypersys-server.com.ar/1/1.mp3/120whoreniggagay.bin