MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bdf8709d58ab512229a343fba8788770076afd816dc2e9a9abcb803d72bf84b4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Dridex


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: bdf8709d58ab512229a343fba8788770076afd816dc2e9a9abcb803d72bf84b4
SHA3-384 hash: 1a61ee12190c1deb59f895a6be75d41ccd6b65cd78a4a8d5cbd24aa7b423caa76b81fc67586a61a9545a13ecf58051c4
SHA1 hash: 336ac80ff1b1bc311fa2793b8d96b03e39b7297b
MD5 hash: c242f4f2c2eb18195e14d9d30ee400aa
humanhash: cola-beryllium-zebra-cardinal
File name:rtghwerthwerrar
Download: download sample
Signature Dridex
Create hunting rule
File size:331'776 bytes
First seen:2020-09-08 13:45:00 UTC
Last seen:2020-09-08 14:48:51 UTC
File type:DLL dll
MIME type:application/x-dosexec
imphash f2beaf48ee70d696a31e2302768ca13e (1 x Dridex)
ssdeep 6144:T0ffNJAPWPAcxyKWjypLSC1jC6sRDPbN8S+myNM+:T0fViPWPAa2jOLLm6sRDeNfNn
TLSH 3964BFA1B2F3E861F1B3FBB5C47C1345692B3995DA3DE20C49601D1C6623992CDF8B62
Reporter JAMESWT_WT
Tags:Dridex

Intelligence

File Origin
# of uploads :
2
# of downloads :
181
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Detection(s):
SecuriteInfo.com.AI.Packer.A2693F311F.29612.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Sending a UDP request
Detection:
dridex
Create hunting rule
Link:
https://mwdb.cert.pl/sample/bdf8709d58ab512229a343fba8788770076afd816dc2e9a9abcb803d72bf84b4/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-09-08 13:46:17 UTC
File Type:
PE (Dll)
AV detection:
25 of 29 (86.21%)
Threat level:
  5/5
Result
Malware family:
dridex
Create hunting rule
Score:
  10/10
Tags:
botnet loader family:dridex
Link:
https://tria.ge/reports/200908-9xt69gsqq2/
Behaviour
Suspicious use of WriteProcessMemory
Dridex Loader
Dridex
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.34
Link:
https://yomi.yoroi.company/submissions/bdf8709d58ab512229a343fba8788770076afd816dc2e9a9abcb803d72bf84b4

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Dridex

DLL dll bdf8709d58ab512229a343fba8788770076afd816dc2e9a9abcb803d72bf84b4

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/455516/
  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/455520/
  
URLhaus
https://urlhaus.abuse.ch/url/455524/
  
URLhaus
https://urlhaus.abuse.ch/url/455529/
  
URLhaus
https://urlhaus.abuse.ch/url/455536/
  
URLhaus
https://urlhaus.abuse.ch/url/455549/
Cape
Cape
https://www.capesandbox.com/analysis/57927/

Comments