MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bd05dc94a9ebcfd40d288bc0afc811bc21024f43b31c51bee50cad75abceed06. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


IcedID


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: bd05dc94a9ebcfd40d288bc0afc811bc21024f43b31c51bee50cad75abceed06
SHA3-384 hash: 97eed4783c4bf727730930940ec00bbe60e4dc2cbb3189dfa1a9d63a0135d3a78fd1da41b584d012348091985bdb070b
SHA1 hash: 1ff7c20092941bd86baa6f5261bd3717eac521af
MD5 hash: c07b821a25d5c1c460562412b27764fc
humanhash: oven-one-kansas-salami
File name:bd05dc94a9ebcfd40d288bc0afc811bc21024f43b31c51bee50cad75abceed06
Download: download sample
Signature IcedID
Create hunting rule
File size:188'416 bytes
First seen:2020-11-12 14:12:30 UTC
Last seen:2024-07-24 20:57:58 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash cd8b5dabc7e8484bce45bec04acf69b4 (2 x Pony, 1 x IcedID)
ssdeep 1536:3JF7NMViEhdyothsvmBN9ltnUg1eYJqXJpZiBE7IGg1W0GGT9ct4hlRv7afv2+oW:P+NPyAjXtnU8ALZ5I7Rcan4fv2DUFv
Threatray 139 similar samples on MalwareBazaar
TLSH A104E141348DF06FCACFEBB1E1E486B0DAA9AC68544C3B314D8F57953D9FB226A80355
Reporter seifreed
Tags:IcedID

Intelligence

File Origin
# of uploads :
2
# of downloads :
53
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Dropper.Remcos-9248708-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
Creating a window
Creating a file in the %AppData% subdirectories
Unauthorized injection to a recently created process
Reading critical registry keys
Connection attempt
Stealing user critical data
Enabling autorun by creating a file
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/bd05dc94a9ebcfd40d288bc0afc811bc21024f43b31c51bee50cad75abceed06/
Threat name:
Win32.Infostealer.PonyStealer
Create hunting rule
Status:
Malicious
First seen:
2020-11-12 14:14:59 UTC
AV detection:
27 of 29 (93.10%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
pony
Create hunting rule
icedid
Create hunting rule
Similar samples:
15009bbe320d77a38e4341a5e160baec142a96f86c730a33dae9a1487399c78c
IcedID
2dba22bb151cb9c5e35304b1a6215374d6857898d217b721f9b5a6e8d973576d
IcedID
59c17773776261d45122a0d067088654268ca71b329a6e9495105c500c12c8c1
IcedID
5a8239ffd5e37023816296c83bf64261d7461cc373669a881a1b2284d767d1ed
IcedID
5dbfd22543849bd392e080c351227f31137993f23ee7ac5a3184322e43d73745
IcedID
68629701b12d1300254ce04807b894fd8195bd36ce6b6ceebe5beba5d60cf5d3
IcedID
87dc16528521b99284a5d7e466d1cd5047c3ca27caaa05a0ea6ccd11b63dd3b8
IcedID
92dd50589b21721bb8b73217b21be6a6c51f6fca5cb19ebea9a0913cfaa7baa8
IcedID
948b5d4daa9864aae1297b9481a1bcee316f723af481e983dbff09fcd8a24563
IcedID
a9ab46452a78667dfb767d2bf2507c607d818463c8a0b8d87cf3b79335247a3e
IcedID
+ 129 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/201112-gzwfgk8ssj/
Behaviour
Suspicious use of SetWindowsHookEx
Unpacked files
SH256 hash:
bd05dc94a9ebcfd40d288bc0afc811bc21024f43b31c51bee50cad75abceed06
MD5 hash:
c07b821a25d5c1c460562412b27764fc
SHA1 hash:
1ff7c20092941bd86baa6f5261bd3717eac521af
Link:
https://www.unpac.me/results/16c723dc-1936-4405-82e9-26cb102faaf8/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Remcos
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/bd05dc94a9ebcfd40d288bc0afc811bc21024f43b31c51bee50cad75abceed06

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other

Comments