MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 accc34541e27e46f4b46339eb25fee6cdccef3c18a849bea359998ebc28f6b59. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Dridex


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: accc34541e27e46f4b46339eb25fee6cdccef3c18a849bea359998ebc28f6b59
SHA3-384 hash: 706e964d6984eff8c035ad82139c451de7a177e434eec47700dcc76f6c4f1d3056ccc1aad483c8bfcaca2194185a3a29
SHA1 hash: c092decfb8d41312964686c8bcab36c5559637f2
MD5 hash: 698e51bc1e2a4642c0ac6ee6eac9791e
humanhash: potato-south-hotel-nuts
File name:698e51bc1e2a4642c0ac6ee6eac9791e.dll
Download: download sample
Signature Dridex
Create hunting rule
File size:335'872 bytes
First seen:2020-09-08 07:41:10 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash a9dcba22e49d69dd17ae0f6b7ed41420 (8 x Dridex)
ssdeep 6144:fJDQdB7ab5FaBYA3JBaUH/kOyQ1SDofgEcwY1KEcyk1emcwQ3oj:fJsveb5FaP1HTyQ14ugjXKjveF
TLSH 4B64D001BBE99084F3BB2BB0D8773199173E3EDBC4F59A2C5A040D5D1CB5B529894BA2
Reporter abuse_ch
Tags:dll Dridex

Intelligence

File Origin
# of uploads :
1
# of downloads :
162
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Detection(s):
SecuriteInfo.com.Trojan.GenericKD.34490150.8497.21617.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:
Detection:
dridex
Create hunting rule
Link:
https://mwdb.cert.pl/sample/accc34541e27e46f4b46339eb25fee6cdccef3c18a849bea359998ebc28f6b59/
Threat name:
Win32.Infostealer.Dridex
Create hunting rule
Status:
Malicious
First seen:
2020-09-07 22:04:46 UTC
File Type:
PE (Dll)
AV detection:
23 of 29 (79.31%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=vtgdiva6e7sg6s2ggoplex7ontom546brkcjx2rvtgmoxqupnnmq._file
Result
Malware family:
dridex
Create hunting rule
Score:
  10/10
Tags:
botnet loader family:dridex
Link:
https://tria.ge/reports/200908-bf8kdwn292/
Behaviour
Suspicious use of WriteProcessMemory
Dridex Loader
Dridex
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/accc34541e27e46f4b46339eb25fee6cdccef3c18a849bea359998ebc28f6b59

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Dridex

DLL dll accc34541e27e46f4b46339eb25fee6cdccef3c18a849bea359998ebc28f6b59

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/455325/
  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/455337/
  
URLhaus
https://urlhaus.abuse.ch/url/455340/
  
URLhaus
https://urlhaus.abuse.ch/url/455342/
  
URLhaus
https://urlhaus.abuse.ch/url/455348/
Cape
Cape
https://www.capesandbox.com/analysis/57816/

Comments