🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 02154f77f157137064fdcfe13971d4f436f0cfa620daefa50e2ce76bbd8c0d12. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


IcedID


Vendor detections: 9


Intelligence 9 IOCs 1 YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 02154f77f157137064fdcfe13971d4f436f0cfa620daefa50e2ce76bbd8c0d12
SHA3-384 hash: e09dc443c84d623a7c0d63a6d8539ce8ba19b3a597e55879d5ca07663d4de62d5ca9f3c0b390445e1409b18c3cf45c31
SHA1 hash: 076e01b3d8530d10a552f3200c1fc3a1de28e213
MD5 hash: beb8f1470b51dd7692023ca47ffaf2b8
humanhash: vegan-three-carbon-magnesium
File name:beb8f1470b51dd7692023ca47ffaf2b8.dll
Download: download sample
Signature IcedID
Create hunting rule
File size:214'528 bytes
First seen:2022-10-29 13:45:32 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 5f3931e8b5b2cabca208c3032e64e333 (30 x IcedID)
ssdeep 3072:r4vjzFD+vHhMTUe0FQgJYAh9apwYUVeNj6OO9I:wzFSvgT+aSe5oI
Threatray 1'174 similar samples on MalwareBazaar
TLSH T18A2406D976D6F0A1D3A751B6403F100BF33A2D1A680C8500F265E9DABCBA55E9237F6C
TrID 48.7% (.EXE) Win64 Executable (generic) (10523/12/4)
23.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
9.3% (.EXE) OS/2 Executable (generic) (2029/13)
9.2% (.EXE) Generic Win/DOS Executable (2002/3)
9.2% (.EXE) DOS Executable Generic (2000/1)
Reporter abuse_ch
Tags:dll exe IcedID


Avatar
abuse_ch
IcedID C2:
nipsontaz.com

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
nipsontaz.com https://threatfox.abuse.ch/ioc/920273/

Intelligence

File Origin
# of uploads :
1
# of downloads :
628
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
beb8f1470b51dd7692023ca47ffaf2b8.dll
Verdict:
No threats detected
Analysis date:
2022-10-29 13:50:07 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/3c7059a7-80ba-47e0-b507-efbe531921cd

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/325858/
Detection(s):
Win.Keylogger.Icedid-9975890-0
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Searching for the window
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/46613/overview
Behaviour
MalwareBazaar
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
75%
Tags:
evasive packed
Link:
https://www.filescan.io/uploads/635d2ea99b2225917c1c35a8/reports/ef7eb24d-2335-4691-9496-84a52c391022/overview
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/173164ad-0a0a-4b26-863a-9b0966b38345
Result
Threat name:
IcedID
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1100898
Signature
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Contains functionality to detect hardware virtualization (CPUID execution measurement)
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
System process connects to network (likely due to code injection or exploit)
Tries to detect virtualization through RDTSC time measurements
Yara detected IcedID
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/02154f77f157137064fdcfe13971d4f436f0cfa620daefa50e2ce76bbd8c0d12/
Threat name:
Win64.Trojan.IcedID
Create hunting rule
Status:
Malicious
First seen:
2022-10-29 00:58:09 UTC
File Type:
PE+ (Dll)
AV detection:
20 of 41 (48.78%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=aiku657rk4jxazh5z7qts4ou6q3pbt5gedno7jiofttwxpmmbuja._file
Verdict:
malicious
Label(s):
icedid
Create hunting rule
Similar samples:
087f0e89e9bbc43ee25e08608fa087ad48e6dcf7e64c9f3f045c2a06619687c2
IcedID
4a914da92267025d533e5b2146ca74766a566e571b968e6d36f347b8602d6543
IcedID
6a0d549052c00a09b37376a0629056316dc9d92cc2e93526375295fb67eda6bd
IcedID
7377b7a3163111fc84b74fb76f4f674d301bfb8cfd4291242e476ec60f07ed1e
IcedID
d9c400014ade9f1b3f3ba8db94faa31c587f7f4d49cd4152b51b35e5c02a2b5a
IcedID
+ 1'164 additional samples on MalwareBazaar
Result
Malware family:
icedid
Create hunting rule
Score:
  10/10
Tags:
family:icedid campaign:3447045697 banker loader trojan
Link:
https://tria.ge/reports/221029-q2y1qaadem/
Behaviour
Suspicious behavior: EnumeratesProcesses
Blocklisted process makes network request
IcedID, BokBot
Unpacked files
SH256 hash:
02154f77f157137064fdcfe13971d4f436f0cfa620daefa50e2ce76bbd8c0d12
MD5 hash:
beb8f1470b51dd7692023ca47ffaf2b8
SHA1 hash:
076e01b3d8530d10a552f3200c1fc3a1de28e213
Link:
https://www.unpac.me/results/3f598f7c-7301-4b2b-b76a-c4497dad7fee/
Malware family:
IcedID
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/02154f77f157/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.16
Link:
https://yomi.yoroi.company/submissions/02154f77f157137064fdcfe13971d4f436f0cfa620daefa50e2ce76bbd8c0d12

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/325858/

Comments