Win64/Dridex.BA removal

The Win64/Dridex.BA is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Win64/Dridex.BA virus can do?

The binary likely contains encrypted or compressed data.
Anomalous binary characteristics

How to determine Win64/Dridex.BA?


File Info:
crc32: 7CA5F90B
md5: e35c61ebe91c031d45c2ae5fee1ce298
name: upload_file
sha1: 18f2b3c265c8cb3dfc839e276c8b991e2dc03eaf
sha256: 6da8b8e1b1f1db5c5497500cc342b5778541c2d6584a958ce64ae77c09895ecc
sha512: 9b29a54deec72ef1e8c713da7659299df77a842e4543b2cf2d09dcea30cc68e87fff71e629acbf76feaada6a6019ac79c9ea438c3dc3d00d44f731bc767e620d
ssdeep: 24576:hhLBOY3Zch8R9trbCPQFaD0JAc8V7M/GGS069NmgsSF:pTFJawGGj6fmg
type: PE32+ executable (DLL) (GUI) x86-64, for MS Windows

Version Info:
LegalCopyright: xa9 Apple Inc. 1989-2016
InternalName: LswdDualo
FileVersion: 7.8.7
CompanyName: Apple Computer, Inc.
ProductName: LswddUalo
ProductVersion: QuickTime 0.0.0
FileDescription: CoreVideo
OriginalFilename: LswdDualo.qtx
Translation: 0x0410 0x04b0

Win64/Dridex.BA also known as:

Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.GenericKD.34594787
McAfee	Drixed-FJI!E35C61EBE91C
Cylance	Unsafe
AegisLab	Trojan.Win64.Injexa.4!c
K7AntiVirus	Trojan ( 0056cab71 )
BitDefender	Trojan.GenericKD.34594787
K7GW	Trojan ( 0056cab71 )
CrowdStrike	win/malicious_confidence_80% (D)
Arcabit	Trojan.Generic.D20FDFE3
TrendMicro	TROJ_FRS.VSNTIP20
Symantec	W64.Cridex
APEX	Malicious
Paloalto	generic.ml
Kaspersky	HEUR:Trojan.Win64.Injexa.vho
Alibaba	Trojan:Application/Kryptik.56fd3256
Tencent	Malware.Win32.Gencirc.11af9236
Ad-Aware	Trojan.GenericKD.34594787
Emsisoft	Trojan.GenericKD.34594787 (B)
Comodo	Malware@#2m0diwv6qtqut
F-Secure	Trojan.TR/Crypt.EPACK.Gen2
DrWeb	Trojan.Siggen10.28215
Invincea	Mal/Generic-S + Troj/Dridex-ABY
McAfee-GW-Edition	BehavesLike.Win64.Drixed.dc
FireEye	Generic.mg.e35c61ebe91c031d
Sophos	Troj/Dridex-ABY
Ikarus	Trojan-Banker.Dridex
Avira	TR/Crypt.EPACK.Gen2
Antiy-AVL	Trojan/Win64.Injexa
Microsoft	Trojan:Win64/Dridex.RAX!MTB
ViRobot	Trojan.Win32.Z.Kryptik.1009152.K
ZoneAlarm	HEUR:Trojan.Win64.Injexa.vho
GData	Trojan.GenericKD.34594787
Cynet	Malicious (score: 90)
ALYac	Spyware.Banker.Dridex
MAX	malware (ai score=84)
Malwarebytes	Trojan.MalPack.RND
Panda	Trj/CI.A
ESET-NOD32	Win64/Dridex.BA
TrendMicro-HouseCall	TROJ_FRS.VSNTIP20
Rising	Trojan.Kryptik!8.8 (TFE:2:Dn04PTKgeCC)
SentinelOne	DFI – Suspicious PE
Fortinet	W64/Kryptik.BZO!tr
AVG	Win64:BankerX-gen [Trj]
Avast	Win64:BankerX-gen [Trj]
Qihoo-360	Win64/Trojan.4a4

How to remove Win64/Dridex.BA?

Win64/Dridex.BA removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X