MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0aa2727753d68654ada04a86531c216b15754fe0fabb38bf5db9c9bd4d8933a8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


IcedID


Vendor detections: 7


Intelligence 7 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0aa2727753d68654ada04a86531c216b15754fe0fabb38bf5db9c9bd4d8933a8
SHA3-384 hash: f573a0ca0b3f9ae7dc4a904663b3af0122570fb245eaefb14a3403dd1844bbef74e6b49dea258ee922f873f6ef9f033c
SHA1 hash: 8700616ac6d73f84e615e7a33d42ac96a7a3b535
MD5 hash: eaee3f4ddd608ce362f8dcdfca40aad6
humanhash: wyoming-shade-arkansas-south
File name:temp.tmp
Download: download sample
Signature IcedID
Create hunting rule
File size:172'032 bytes
First seen:2020-08-13 18:48:26 UTC
Last seen:2020-08-13 19:43:48 UTC
File type:DLL dll
MIME type:application/x-dosexec
imphash 7dba58da61785bfb99de571c94414d2d (12 x IcedID, 2 x Gozi)
ssdeep 1536:hF+KOaaJzE/2b3RDdJQ5ZU5m/Yzs/8OXmlWunuZtH2WY8+pt6PytN8bUMWf:hF6JAkhR2Ssfm0tH/+poPANjTf
Threatray 620 similar samples on MalwareBazaar
TLSH 1BF37D113AE28071F267063E8260CA51CF7D39537ABED78FA7D4079EE9639805B313A5
Reporter malware_traffic
Tags:dll IcedID Shathak TA551

Intelligence

File Origin
# of uploads :
2
# of downloads :
165
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/45350/
Detection(s):
PUA.Win.Packer.PrivateExeProte-11
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
DNS request
Sending a custom TCP request
Result
Threat name:
IcedID
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
60 / 100
Link:
https://www.joesandbox.com/analysis/427400
Signature
Contains functionality to detect hardware virtualization (CPUID execution measurement)
System process connects to network (likely due to code injection or exploit)
Yara detected IcedID
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 266281 Sample: temp.tmp Startdate: 15/08/2020 Architecture: WINDOWS Score: 60 19 www.oracle.com 2->19 35 Yara detected IcedID 2->35 7 loaddll32.exe 1 2->7         started        signatures3 process4 process5 9 rundll32.exe 7->9         started        13 rundll32.exe 7->13         started        15 rundll32.exe 7->15         started        17 rundll32.exe 7->17         started        dnsIp6 21 s.twitter.com 104.244.42.131, 443, 49763 TWITTERUS United States 9->21 23 192.168.2.1 unknown unknown 9->23 29 7 other IPs or domains 9->29 37 System process connects to network (likely due to code injection or exploit) 9->37 39 Contains functionality to detect hardware virtualization (CPUID execution measurement) 9->39 25 www.oracle.com 13->25 27 support.oracle.com 13->27 31 2 other IPs or domains 15->31 33 2 other IPs or domains 17->33 signatures7
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0aa2727753d68654ada04a86531c216b15754fe0fabb38bf5db9c9bd4d8933a8/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-08-13 18:41:23 UTC
AV detection:
23 of 29 (79.31%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=bkrhe52t22dfjlnajkdfghbbnmkxkt7a7k5trp25xhe32tmjgoua._file
Verdict:
malicious
Label(s):
icedid
Create hunting rule
gozi
Create hunting rule
Similar samples:
34d6e9e7f32a1c02b1bb0e3a5c89789b8a917e84087d759e8361727985bddddc
IcedID
4060134612ebdaae96a4dea94b5b876f7bfee97cd5d1e0e6f8659c71165cc476
IcedID
45100eae0d92ac2d1142ffd48e6b478c78ca3707601705e867e0e6597e385c5d
IcedID
60adb0a8bb01a52de96c31213433954834f2ca43b677ec67737ad12e633a5c18
IcedID
69040cacea68c86159731cd1d2c46963d51bd3701877053d5d43947cd17149f3
IcedID
8b523f455bedd162d9647c3ed04ee97edf7638c097afe1dc5f0bc8f402c270fd
IcedID
94349d76ec1a0c4f60d8d6b59e5dd0883a533a17c9a7c7a87cab5d4540e5d4ea
IcedID
bbd6bde5b8c92642cf6bf2cc0e3c64e41079b1a4a587423265fe9d589bf4d1f3
IcedID
cbe3062225faebf38b5f05aad6ebaddadccf5a41fda7e075d8264b2df7d66150
IcedID
e5f1b3c69e967ec1531a0fb923599009fd86a9667110079be0b8cf50360f4e8c
IcedID
+ 610 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
n/a
Link:
https://tria.ge/reports/200813-lz5v1y81zj/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Modifies system certificate store
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Blacklisted process makes network request
Blacklisted process makes network request
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Trojan
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/0aa2727753d68654ada04a86531c216b15754fe0fabb38bf5db9c9bd4d8933a8

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/45350/

Comments