MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 69f0200223c9d03d6150c4d0e5bab6dd5654618400716a84a61dc018dc61e57f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Dridex


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 69f0200223c9d03d6150c4d0e5bab6dd5654618400716a84a61dc018dc61e57f
SHA3-384 hash: e067d5ee876cc1991df57f357efe5aff3e93a2ab8a5144f4309ed3d9758d4f16f4ddebfee57ee24613f5518d6d1d9e8c
SHA1 hash: 8fba4f999d40ec937bb09185d111033d2c68e373
MD5 hash: 8d93086b18da9f4479483489fd8e65e1
humanhash: romeo-bakerloo-leopard-fillet
File name:Hzbazg4zm.bin
Download: download sample
Signature Dridex
Create hunting rule
File size:331'776 bytes
First seen:2020-09-08 14:24:17 UTC
Last seen:2020-09-08 14:48:48 UTC
File type:DLL dll
MIME type:application/x-dosexec
imphash 80720882903e52c683c983218e5c7ec4 (2 x Dridex)
ssdeep 6144:6mE86CUcxqWBiW+0tF7Il1sztcvwIH+Dinifl4lX8ljMl93ha:Q86QxqWBi50tF7Il1szmvwLhcX4jI98
TLSH A664D04A77A851A4E3B31A75D432602F8E3876E07C74FB4E16A81CCCD7A3D39C961396
Reporter JAMESWT_WT
Tags:Dridex

Intelligence

File Origin
# of uploads :
2
# of downloads :
199
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Detection(s):
SecuriteInfo.com.AI.Packer.C31685301F.9468.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Sending a UDP request
Detection:
dridex
Create hunting rule
Link:
https://mwdb.cert.pl/sample/69f0200223c9d03d6150c4d0e5bab6dd5654618400716a84a61dc018dc61e57f/
Threat name:
Win32.Infostealer.Dridex
Create hunting rule
Status:
Malicious
First seen:
2020-09-08 14:23:07 UTC
File Type:
PE (Dll)
AV detection:
24 of 29 (82.76%)
Threat level:
  5/5
Result
Malware family:
dridex
Create hunting rule
Score:
  10/10
Tags:
botnet loader family:dridex
Link:
https://tria.ge/reports/200908-t4hgalh3a6/
Behaviour
Suspicious use of WriteProcessMemory
Dridex Loader
Dridex
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Virus
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/69f0200223c9d03d6150c4d0e5bab6dd5654618400716a84a61dc018dc61e57f

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/57945/

Comments