🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 00dcc4642d488643856259cd3c576d9e24045b48783fc21ebdccd5fb4de66f8c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


IcedID


Vendor detections: 5


Intelligence 5 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 00dcc4642d488643856259cd3c576d9e24045b48783fc21ebdccd5fb4de66f8c
SHA3-384 hash: 15fa532240bcfa280f99605709c6306dea0d954864855eb4b49577ff013da8ce686854dea31b0851814d71a2f297a676
SHA1 hash: 08ffb813d1d7544380aa1b0e41703207451e1def
MD5 hash: 88789ba7f00909005b2fe18ce83dbf58
humanhash: tennis-venus-oscar-blossom
File name:sol3nia.dll
Download: download sample
Signature IcedID
Create hunting rule
File size:364'032 bytes
First seen:2022-06-24 08:11:43 UTC
Last seen:2022-06-24 08:54:11 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f9f6081297aa41ac70321f2eddd306be (2 x IcedID, 1 x BumbleBee)
ssdeep 6144:vi6CAPF0IVqcbMQmJU+GkJXzgNLyKTknXKVp5/yQLGG/z2mpS8PUzdJd:HCEqcbMQCU+n9zgNOKTRp59jimY8PW
Threatray 1 similar samples on MalwareBazaar
TLSH T19074AFB8B5047DD6E67E537BDA99ADDD13B6272289CBA4CD40A4BBC30563371FE02804
TrID 63.5% (.EXE) Win64 Executable (generic) (10523/12/4)
12.2% (.EXE) OS/2 Executable (generic) (2029/13)
12.0% (.EXE) Generic Win/DOS Executable (2002/3)
12.0% (.EXE) DOS Executable Generic (2000/1)
Reporter proxylife
Tags:exe IcedID

Intelligence

File Origin
# of uploads :
2
# of downloads :
266
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/282936/
Result
Verdict:
Clean
Maliciousness:
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Link:
https://www.filescan.io/uploads/62b57212666084d7254af4c3/reports/6b620a08-296d-43fd-b577-e8d938cf7804/overview
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/e02fa4af-24d3-4a0c-822e-ff8b3c4fd258
Result
Threat name:
Unknown
Detection:
clean
Classification:
n/a
Score:
2 / 100
Link:
https://www.joesandbox.com/analysis/1019156
Behaviour
Behavior Graph:
n/a
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/00dcc4642d488643856259cd3c576d9e24045b48783fc21ebdccd5fb4de66f8c/
Threat name:
Win64.Trojan.IcedID
Create hunting rule
Status:
Malicious
First seen:
2022-06-24 08:12:07 UTC
File Type:
PE+ (Dll)
Extracted files:
1
AV detection:
14 of 26 (53.85%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=adomizbnjcdehblclhgtyv3ntysaiw2ipa74ehv5ztk7wtpgn6ga._file
Verdict:
unknown
Similar samples:
0e72441cf05dd9cf1013251e102dcd0f48e4fa9408542a615c719c31601d7b22
IcedID
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/220624-j3tztsdgc7/
Behaviour
Suspicious use of WriteProcessMemory
Program crash
Unpacked files
SH256 hash:
00dcc4642d488643856259cd3c576d9e24045b48783fc21ebdccd5fb4de66f8c
MD5 hash:
88789ba7f00909005b2fe18ce83dbf58
SHA1 hash:
08ffb813d1d7544380aa1b0e41703207451e1def
Link:
https://www.unpac.me/results/7012d58b-5693-4de9-a49c-4a589bb0dd92/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/00dcc4642d488643856259cd3c576d9e24045b48783fc21ebdccd5fb4de66f8c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:SPLCrypt
Create hunting rule
Author:James Quinn, Binary Defense
Description:Identifies SPLCrypt, a new crypter associated with Bazaloader

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/282936/

Comments