MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0ac2ea4c04f4a6bbd8d3da29f634bed6faebfef99d64fb1637756142bfda4f9a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


IcedID


Vendor detections: 7


Intelligence 7 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0ac2ea4c04f4a6bbd8d3da29f634bed6faebfef99d64fb1637756142bfda4f9a
SHA3-384 hash: 7aecbc1b11fceff8589eba4e8dc70ec4b1de9decaf06241f6b23fbd5055bd452b07ebf73644d7c7f61fab0d88d041385
SHA1 hash: 998531c9882c3e06026d8ce8e37dc55e8096bed4
MD5 hash: c732eeff4bf270c07a8aea11e609182e
humanhash: march-gee-alanine-speaker
File name:0104.gif.dll
Download: download sample
Signature IcedID
Create hunting rule
File size:235'400 bytes
First seen:2021-04-01 11:35:12 UTC
Last seen:2021-04-01 11:35:58 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 3eb5471c5370e4bcb3be6637e4995a6b (33 x IcedID)
ssdeep 3072:OCHCrCVCVC/CtCczk8PkyGtzjU0c28vPr:Wk8PpIzw0c2sP
Threatray 1'074 similar samples on MalwareBazaar
TLSH E034C5C6A5BE12B7D81F4272609206385B217FD14ADB8FDFCE685E4D56137E0A827323
Reporter JAMESWT_WT
Tags:dll IcedID

Intelligence

File Origin
# of uploads :
2
# of downloads :
104
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
document-1003111324.xls
Verdict:
Malicious activity
Analysis date:
2021-04-01 11:34:16 UTC
Tags:
macros macros40
Link:
https://app.any.run/tasks/f149f3c6-e979-4e3e-9e46-5c732dbe8709

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
IcedIDStage1
Create hunting rule
Link:
https://www.capesandbox.com/analysis/130743/
Detection(s):
SecuriteInfo.com.ArtemisA33755E0598F.7790.30343.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
DNS request
Sending a custom TCP request
Sending an HTTP GET request
Sending a UDP request
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0ac2ea4c04f4a6bbd8d3da29f634bed6faebfef99d64fb1637756142bfda4f9a/
Threat name:
Win64.Trojan.Ligooc
Create hunting rule
Status:
Malicious
First seen:
2021-04-01 11:36:08 UTC
File Type:
PE+ (Dll)
AV detection:
13 of 29 (44.83%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=blboutae6stlxwgt3iu7mnf6235ox7xztvspwfrxovqufp62j6na._file
Verdict:
malicious
Label(s):
icedid
Create hunting rule
Similar samples:
1c9e1807c9a1b6c46cf5d4a3747a005cdf39b5373ccf093723831ed1d6ca1950
IcedID
846f3a3a0964cb9dd54c38be3d4c82f646972f486c42e064b44c3f0eedd2d292
IcedID
a2f79cd85a51b85174c51ef9a259dcd7605ced04d7954ed3ae7aa97f55d1ddc4
IcedID
a49760079884f6c27fde5e1b54048ac2a0b4bcc246fb7ce9644e1230de9fcde7
IcedID
ad55ee61eac8ad1cc7dcb16a3aa375a32e4f1fd9760b5895e2248b624e8f3496
IcedID
be428c356669962ffc29fbd6c64d0e77f36fcd162349582d29772803d2eaa80c
IcedID
be435861dc2be74be71d514183344d202ab394c84bc4c27dde86e9239ff48238
IcedID
c642e0dba47e263aa8ce792276b5483b09951c68fd2554ee9563a5bc4fe802a0
IcedID
f1018296b1809bcd9d9428a6b515f403f0ec801ff6b2f71bd84a4d06d8d12ca9
IcedID
f75eb673f63060d1a8726b6d7255555eda5873b8a95c8efcea1bb9eb61972c1f
IcedID
+ 1'064 additional samples on MalwareBazaar
Result
Malware family:
icedid
Create hunting rule
Score:
  10/10
Tags:
family:icedid banker loader trojan
Link:
https://tria.ge/reports/210401-bcjfwxc1dx/
Behaviour
Suspicious behavior: EnumeratesProcesses
IcedID First Stage Loader
IcedID, BokBot
Malware Config
C2 Extraction:
tvorartificialnature.xyz
Unpacked files
SH256 hash:
0ac2ea4c04f4a6bbd8d3da29f634bed6faebfef99d64fb1637756142bfda4f9a
MD5 hash:
c732eeff4bf270c07a8aea11e609182e
SHA1 hash:
998531c9882c3e06026d8ce8e37dc55e8096bed4
Link:
https://www.unpac.me/results/0f9b69f3-d7ab-40a6-8322-8f37adfe8fa9/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.46
Link:
https://yomi.yoroi.company/submissions/0ac2ea4c04f4a6bbd8d3da29f634bed6faebfef99d64fb1637756142bfda4f9a

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

IcedID

Executable exe 0ac2ea4c04f4a6bbd8d3da29f634bed6faebfef99d64fb1637756142bfda4f9a

(this sample)

Cape
Cape
https://www.capesandbox.com/analysis/130743/
  
URLhaus
https://urlhaus.abuse.ch/url/1100970/
  
Delivery method
Distributed via web download

Comments