MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 19bc003eab42141cbc9a0e9103345594c057c587225b3ae6a62cc9ce1629d534. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Dridex


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 19bc003eab42141cbc9a0e9103345594c057c587225b3ae6a62cc9ce1629d534
SHA3-384 hash: 7bdacf7f9dbff029469620f7f559d3fa556d0fa1f93e8f78b4c599dd2004723dfab372cf4d01595019a1698f0289f0f0
SHA1 hash: 46552fba600c2bdbf91e75eddefc45f9f57b741a
MD5 hash: cd56a95ff1aaaf765e36723f20601f45
humanhash: lion-freddie-kentucky-georgia
File name:cd56a95ff1aaaf765e36723f20601f45.dll
Download: download sample
Signature Dridex
Create hunting rule
File size:8'110 bytes
First seen:2021-01-13 19:44:23 UTC
Last seen:2021-01-13 21:59:39 UTC
File type:DLL dll
MIME type:application/x-dosexec
ssdeep 48:6bwywOEP6zJStf3FrFEiSCyiiIiYioi4iIZ4IYoNN9tdN+ueO+Y7LbrkUk0EUZJ/:cEPeu
TLSH F3F15093E476E3EDD7632276B0E2D0D78D21CEA89690786B4C63742933DCAC5EC34219
Reporter abuse_ch
Tags:dll Dridex

Intelligence

File Origin
# of uploads :
2
# of downloads :
166
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/111813/
Detection(s):
SecuriteInfo.com.Trojan.Dridex.735.10013.4825.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Unknown
Detection:
suspicious
Classification:
n/a
Score:
24 / 100
Link:
https://www.joesandbox.com/analysis/580546
Signature
Machine Learning detection for sample
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 339313 Sample: UCrAjlGTu3.dll Startdate: 13/01/2021 Architecture: WINDOWS Score: 24 10 Machine Learning detection for sample 2->10 6 loaddll32.exe 1 2->6         started        process3 process4 8 WerFault.exe 6 9 6->8         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/19bc003eab42141cbc9a0e9103345594c057c587225b3ae6a62cc9ce1629d534/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2021-01-13 19:45:06 UTC
AV detection:
14 of 46 (30.43%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=dg6aapvliikbzpe2b2iqgncvstafprmhejntvzvgfte44frj2u2a._file
Verdict:
unknown
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/210113-b3advkaedj/
Behaviour
Suspicious use of WriteProcessMemory
Unpacked files
SH256 hash:
19bc003eab42141cbc9a0e9103345594c057c587225b3ae6a62cc9ce1629d534
MD5 hash:
cd56a95ff1aaaf765e36723f20601f45
SHA1 hash:
46552fba600c2bdbf91e75eddefc45f9f57b741a
Link:
https://www.unpac.me/results/b001c363-7343-4f06-bd97-192a1b3d5dc7/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.14
Link:
https://yomi.yoroi.company/submissions/19bc003eab42141cbc9a0e9103345594c057c587225b3ae6a62cc9ce1629d534

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Dridex

DLL dll 19bc003eab42141cbc9a0e9103345594c057c587225b3ae6a62cc9ce1629d534

(this sample)

Cape
Cape
https://www.capesandbox.com/analysis/111813/
  
URLhaus
https://urlhaus.abuse.ch/url/840522/
  
Delivery method
Distributed via web download

Comments