MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 19606ec86d32dc8ba78bfd13eddd8e44b081e1e3376c8c512ef5dd105891f098. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Dridex


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 19606ec86d32dc8ba78bfd13eddd8e44b081e1e3376c8c512ef5dd105891f098
SHA3-384 hash: cba63ad409ef8343afa80895a062e81ad5ec550852303b6ec992d19be9aea8e1cded091155ca3a7dc1438735962e33c5
SHA1 hash: cb147397ebe673a9520fc28850a3bdceb3f610f8
MD5 hash: b17ab79dcaac03934df3224d520ecefc
humanhash: sweet-east-quebec-quiet
File name:w56hbw4r56heh6gif
Download: download sample
Signature Dridex
Create hunting rule
File size:331'776 bytes
First seen:2020-09-08 13:49:04 UTC
Last seen:2020-09-08 14:48:56 UTC
File type:DLL dll
MIME type:application/x-dosexec
imphash 9d2a45807ce72b6c39806f12c1ae64fa (7 x Dridex)
ssdeep 6144:ziJLzzXB9KS/9e9wvVUJLp6CUlpz4OIJwknWoCAwr0wKsM28MuHx3:zsR3/9e9wvVUJLp6CUlpz4OIJwkniAwC
TLSH 8864E125E4FD0418E077B7B2D939A812462D7553F87DCE8C5F23A71E84763A08D26FA2
Reporter JAMESWT_WT
Tags:Dridex

Intelligence

File Origin
# of uploads :
2
# of downloads :
182
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Detection(s):
SecuriteInfo.com.FileRepMalware.961.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Sending a UDP request
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/19606ec86d32dc8ba78bfd13eddd8e44b081e1e3376c8c512ef5dd105891f098/
Threat name:
Win32.Infostealer.Dridex
Create hunting rule
Status:
Malicious
First seen:
2020-09-08 13:50:18 UTC
File Type:
PE (Dll)
AV detection:
23 of 29 (79.31%)
Threat level:
  5/5
Result
Malware family:
dridex
Create hunting rule
Score:
  10/10
Tags:
botnet loader family:dridex
Link:
https://tria.ge/reports/200908-42nfdln9kx/
Behaviour
Suspicious use of WriteProcessMemory
Dridex Loader
Dridex
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.54
Link:
https://yomi.yoroi.company/submissions/19606ec86d32dc8ba78bfd13eddd8e44b081e1e3376c8c512ef5dd105891f098

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Dridex

DLL dll 19606ec86d32dc8ba78bfd13eddd8e44b081e1e3376c8c512ef5dd105891f098

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/455508/
  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/455518/
  
URLhaus
https://urlhaus.abuse.ch/url/455526/
  
URLhaus
https://urlhaus.abuse.ch/url/455537/
  
URLhaus
https://urlhaus.abuse.ch/url/455542/
  
URLhaus
https://urlhaus.abuse.ch/url/455548/
Cape
Cape
https://www.capesandbox.com/analysis/57930/

Comments