MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 050b81e9374afaa5e5fbbc92f97da1958dbcfc1410ae378b790cebb74c08d3d3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Dridex


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 050b81e9374afaa5e5fbbc92f97da1958dbcfc1410ae378b790cebb74c08d3d3
SHA3-384 hash: 94b6fbf30ee39a3b705cf67dc8bbd976c121b34093fc2008c5d6de5cd3d36c7da9fd15db007a6ae42b4a9fd16f97cd3c
SHA1 hash: ec5cfb8d819e348dc26592359c1beb6175a1b7cb
MD5 hash: a4457c5dc9e61bf12e482909b5d77566
humanhash: fillet-magnesium-tennessee-july
File name:604508_12_09_2020_3.zip
Download: download sample
Signature Dridex
Create hunting rule
File size:54'164 bytes
First seen:2020-12-10 12:09:01 UTC
Last seen:2020-12-10 12:36:58 UTC
File type: zip
MIME type:application/zip
ssdeep 1536:v8m1zeH22woDlFGG7BNhtW6+edl4FbxWf2FFE:f1z2xwdazq6+Kl4Fb01
TLSH 8B33F192DDC23E2C5323FD7AB7A06B2D81E89F0C87252417AFC71F5DA999B536702064
Reporter cocaman
Tags:Dridex zip


Avatar
cocaman
Malicious email (T1566.001)
From: "Credit and Collections Dept <Dillion.Shaw@msc.com>" (likely spoofed)
Received: "from host-2-114-162-209.business.telecomitalia.it (host-2-114-162-209.business.telecomitalia.it [2.114.162.209]) "
Date: "Thu, 10 Dec 2020 12:19:01 +0100"
Subject: "overdue invoice"
Attachment: "144157_12_09_2020_9.zip"

Intelligence

File Origin
# of uploads :
10
# of downloads :
221
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
TwinWave.EvilDoc.Dridex.LoneSwordsman.20201207.UNOFFICIAL
Create hunting rule

Sanesecurity.Badmacro.Xls.AwSpl.UNOFFICIAL
Create hunting rule

Result
Verdict:
SUSPICIOUS
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/050b81e9374afaa5e5fbbc92f97da1958dbcfc1410ae378b790cebb74c08d3d3/
Threat name:
Script-Macro.Trojan.ZLoader
Create hunting rule
Status:
Malicious
First seen:
2020-12-10 11:36:23 UTC
File Type:
Binary (Archive)
Extracted files:
31
AV detection:
20 of 29 (68.97%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=aufyd2jxjl5klzp3xsjps7nbswg3z7auccxdpc3zbtv3otai2pjq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/050b81e9374afaa5e5fbbc92f97da1958dbcfc1410ae378b790cebb74c08d3d3

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Dridex

zip 050b81e9374afaa5e5fbbc92f97da1958dbcfc1410ae378b790cebb74c08d3d3

(this sample)

Dridex

Excel file xls 005e9151ee4b6399cd27d282bd53104ef59bd89fd3fb65c05cd959992f770afa

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 005e9151ee4b6399cd27d282bd53104ef59bd89fd3fb65c05cd959992f770afa
  
Dropping
ZLoader

Comments