MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cb0e070326a9ad65db83d61c226e1df30b721a61ef76a6675cb6f025bad513a8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Dridex


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: cb0e070326a9ad65db83d61c226e1df30b721a61ef76a6675cb6f025bad513a8
SHA3-384 hash: d03139ad5de6f1cc452db23d4bc05c9e83c9eddd04ad14bb631437288ea30864d702c1a44f03b3a9aef8fffb6e31d443
SHA1 hash: 094b57503abd461998b6cea02c68e3ea5f7c6649
MD5 hash: c0d0d7e3c37e94f950dcacd57e2aa21a
humanhash: massachusetts-december-harry-venus
File name:wrtjw46jnw46jzip
Download: download sample
Signature Dridex
Create hunting rule
File size:331'776 bytes
First seen:2020-09-08 13:54:35 UTC
Last seen:2020-09-08 15:38:49 UTC
File type:DLL dll
MIME type:application/x-dosexec
imphash 9d2a45807ce72b6c39806f12c1ae64fa (7 x Dridex)
ssdeep 6144:vTqLzzXB9KS/9e9wvVUJLp6CUlpz4OIJwknWoCAwr0wKsM28MuHx3:vMR3/9e9wvVUJLp6CUlpz4OIJwkniAwC
TLSH 9464E125E4FD0418E077B7B2D939A812462D7553F87DCE8C5F23A71E84763A08D26FA2
Reporter JAMESWT_WT
Tags:Dridex

Intelligence

File Origin
# of uploads :
3
# of downloads :
190
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Detection(s):
SecuriteInfo.com.FileRepMalware.7891.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Sending a UDP request
Detection:
dridex
Create hunting rule
Link:
https://mwdb.cert.pl/sample/cb0e070326a9ad65db83d61c226e1df30b721a61ef76a6675cb6f025bad513a8/
Threat name:
Win32.Infostealer.Dridex
Create hunting rule
Status:
Malicious
First seen:
2020-09-08 13:56:09 UTC
File Type:
PE (Dll)
AV detection:
24 of 29 (82.76%)
Threat level:
  5/5
Result
Malware family:
dridex
Create hunting rule
Score:
  10/10
Tags:
botnet loader family:dridex
Link:
https://tria.ge/reports/200908-6wtctx92da/
Behaviour
Suspicious use of WriteProcessMemory
Dridex Loader
Dridex
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.34
Link:
https://yomi.yoroi.company/submissions/cb0e070326a9ad65db83d61c226e1df30b721a61ef76a6675cb6f025bad513a8

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Dridex

DLL dll cb0e070326a9ad65db83d61c226e1df30b721a61ef76a6675cb6f025bad513a8

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/455510/
  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/455515/
  
URLhaus
https://urlhaus.abuse.ch/url/455517/
  
URLhaus
https://urlhaus.abuse.ch/url/455525/
  
URLhaus
https://urlhaus.abuse.ch/url/455532/
Cape
Cape
https://www.capesandbox.com/analysis/57935/

Comments