MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 089b3975338c69d1c8ae96cec13328459e8208c7cf9c88ce98896b90697c140b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

IcedID

Vendor detections: 5

Intelligence 5 IOCs YARA 1 File information Comments

SHA256 hash:	089b3975338c69d1c8ae96cec13328459e8208c7cf9c88ce98896b90697c140b
SHA3-384 hash:	5358499956de7bd889e055280f734a38b3869eb89b124f249e3253c901c051c30d8eaf6a3974222c158cc6be98f31437
SHA1 hash:	6b940b7557d96c16212bb08113c4cc9adbd5c009
MD5 hash:	3344c077b5b2b67532a71d0a2ccdd1e2
humanhash:	table-october-single-timing
File name:	main.exe
Download:	download sample
Signature	IcedID Create hunting rule
File size:	31'040'363 bytes
First seen:	2021-10-21 23:22:23 UTC
Last seen:	2021-10-22 00:08:54 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	2cdcfb3a828433ba76b5b41f45519bd9 (2 x ROKRAT, 1 x IcedID)
ssdeep	786432:cUC1bfXxzxOErULMufBZ4MKYQpMArwvOHt2m3QdM:cUC17XpYEgjfBmMKYhAtt2md
Threatray	23 similar samples on MalwareBazaar
TLSH	T1EB6733142DA418CAF9E14036E6678931D17EF5465300C88F7BF4DB072ADB9AA4E3FE49
File icon (PE):
dhash icon	aebc385c4ce0e8f8 (10 x PythonStealer, 7 x RedLineStealer, 7 x DCRat)
Reporter	JaffaCakes118
Tags:	exe IcedID

Intelligence

File Origin

# of uploads :

# of downloads :

168

Origin country :

n/a

Vendor Threat Intelligence

Result

Verdict:

Clean

Maliciousness:

Behaviour

Creating a file in the %temp% subdirectories

Deleting a recently created file

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

greyware overlay packed python

Link:

https://www.filescan.io/uploads/6171f658a9d585e6d532fe94/reports/69d5eb02-5dc6-4f60-8d7c-b235f2f0eb05/overview

Result

Verdict:

UNKNOWN

Result

Threat name:

Unknown

Detection:

malicious

Classification:

spyw

Score:

52 / 100

Link:

https://www.joesandbox.com/analysis/874928

Signature

Multi AV Scanner detection for submitted file

Tries to harvest and steal browser information (history, passwords, etc)

Behaviour

Behavior Graph:

Download SVG

Gathering data

Threat name:

Win64.Infostealer.Generic

Status:

Suspicious

First seen:

2021-10-21 23:23:05 UTC

AV detection:

4 of 44 (9.09%)

Threat level:

5/5

Result

Malware family:

n/a

Score:

7/10

Tags:

pyinstaller spyware stealer

Link:

https://tria.ge/reports/211021-3c47naahe4/

Behaviour

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Loads dropped DLL

Reads user/profile data of web browsers

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/089b3975338c69d1c8ae96cec13328459e8208c7cf9c88ce98896b90697c140b

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	PyInstaller Create hunting rule
Author:	@bartblaze
Description:	Identifies executable converted using PyInstaller.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

IcedID

exe 089b3975338c69d1c8ae96cec13328459e8208c7cf9c88ce98896b90697c140b

(this sample)

Delivery method

Distributed via web download

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample