MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d9405516d908f39043c9971884df73b57ae6db3002364444ec9b4e2a1d026ddb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Dridex


Vendor detections: 6


Intelligence 6 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d9405516d908f39043c9971884df73b57ae6db3002364444ec9b4e2a1d026ddb
SHA3-384 hash: 401439ba70f2a1fa8f2d904f602164ba565b5da7074b909a1eac97f51fd6925f8e2fafe0545f5597bea128ed28d24146
SHA1 hash: dcf9dc94a9e4760af9350f3d3bf32781c4c5d236
MD5 hash: ec143ee5d90b68fea6a3b2fa68217fa9
humanhash: item-neptune-fifteen-robert
File name:d9405516d908f39043c9971884df73b57ae6db3002364444ec9b4e2a1d026ddb.bin
Download: download sample
Signature Dridex
Create hunting rule
File size:7'840 bytes
First seen:2020-09-23 14:05:58 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash c43b3a6af3d178e4f5dd1a23260a65e6 (1 x Dridex)
ssdeep 192:ZTjZaBtPoClYH7TXbUimepqW44nuumtuOf:qJo7TPmeUH0auOf
Threatray 35 similar samples on MalwareBazaar
TLSH 76F10B43D982F473CA4B05F2954FEBBA05C54A21DB205CA79E2C08FEEFA75702921277
Reporter JAMESWT_WT
Tags:Dridex


Avatar
JAMESWT_WT
@ Arkbird_SOLG

Intelligence

File Origin
# of uploads :
1
# of downloads :
159
Origin country :
n/a
Vendor Threat Intelligence
Detection:
DridexV4
Create hunting rule
Link:
https://www.capesandbox.com/analysis/64863/
Detection(s):
SecuriteInfo.com.Variant.Razy.754455.7026.30704.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:
Result
Threat name:
Unknown
Detection:
malicious
Classification:
n/a
Score:
56 / 100
Link:
https://www.joesandbox.com/analysis/473427
Signature
Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d9405516d908f39043c9971884df73b57ae6db3002364444ec9b4e2a1d026ddb/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-09-23 14:06:40 UTC
File Type:
PE (Dll)
AV detection:
15 of 29 (51.72%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
dridex
Create hunting rule
Similar samples:
10d2dca371bee5330d7ebcd022dbd1baddd3dc8ed4b3b602ce1efe333f79b9c9
Dridex
16236a7967ffcae726ad1c8fff934e7c852ea2216d28bd73f26beb4d74a30bc0
Dridex
4d7fd7d58f0bbd4318dfad6767b1046a25f9fc2915ca41b4763be74da56683a5
Dridex
73849ce478a894f10589cc31aece7dcb8a39c1c43a4a5c401b2dae86b53bb9c7
Dridex
8ae193225bd1a7192315a7003aa4aa9565c573b6078f48cc9e290c9b0798235e
Dridex
b0ebc236d8c390a4e4e4f03fc9cdc0bfadbc1c487777a40592015c016db09612
Dridex
c8cca37f43f4aa66b4bfbf811931c57971d2f1571cfebbb7d24235c07e108f26
Dridex
d18d211cf75fbc048d785af92b76a1aa7a01e381313b1a5e66e9cf564cbe78d4
Dridex
ee336755a22c0bb4a25a54b9c61546f73c9f2a9ea5cd3333db76df78258bb6b9
Dridex
fd4159627ae84c3010c4fa3398c64d9639997d795338ab11fe2ad464f160b74e
Dridex
+ 25 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/200923-563bxwxlfa/
Behaviour
Suspicious use of WriteProcessMemory
Suspicious use of WriteProcessMemory
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
XPACK
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/d9405516d908f39043c9971884df73b57ae6db3002364444ec9b4e2a1d026ddb

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:win_dridex_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/64863/

Comments