MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0e83c4eaf4cb50e296bab7738221164b6866ec623d7fee90382c0cc2587c4464. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

IcedID

Vendor detections: 5

Intelligence 5 IOCs 1 YARA 1 File information Comments

SHA256 hash:	0e83c4eaf4cb50e296bab7738221164b6866ec623d7fee90382c0cc2587c4464
SHA3-384 hash:	edee71c4cdf982b97667594aeb9c721148ecbb12db09d0be705c70b151dbdbb1fc580f4cc74a76683be379c006c81aa7
SHA1 hash:	5b174df7f8e21bebc47da1594cb6524252226c84
MD5 hash:	949378220efeb4a2ffb96367e4fd9e98
humanhash:	cup-black-romeo-thirteen
File name:	949378220efeb4a2ffb96367e4fd9e98.dll
Download:	download sample
Signature	IcedID Create hunting rule
File size:	55'840 bytes
First seen:	2021-03-31 19:14:23 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
ssdeep	1536:MhQeEn2s56EdRX096SioHkvr+LlXpFyrEU:MqRjH0Eptvr+FzxU
Threatray	93 similar samples on MalwareBazaar
TLSH	E2437CCAC9B20663C536A971C2F12B18D122B760F393AAFBD1483365C1426D0DB737A6
Reporter	abuse_ch
Tags:	dll IcedID

abuse_ch

IcedID C2:
oceanwaterfree34.xyz

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOC	ThreatFox Reference
oceanwaterfree34.xyz	https://threatfox.abuse.ch/ioc/6321/

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

949378220efeb4a2ffb96367e4fd9e98.dll

Verdict:

No threats detected

Analysis date:

2021-04-01 02:29:33 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/eb5cdc86-b4be-4a42-9003-14e8f051f0e1

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/129944/

Detection(s):

SecuriteInfo.com.Artemis949378220EFE.7741.28034.UNOFFICIAL

Result

Verdict:

Clean

Maliciousness:

Behaviour

DNS request

Sending a custom TCP request

Sending a UDP request

Result

Verdict:

UNKNOWN

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/0e83c4eaf4cb50e296bab7738221164b6866ec623d7fee90382c0cc2587c4464/

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=b2b4j2xuznioffv2w5zyeiiwjnugn3dchv765ebyfqgmewd4irsa._file

Verdict:

malicious

Result

Malware family:

icedid

Score:

10/10

Tags:

family:icedid banker loader trojan

Link:

https://tria.ge/reports/210331-xph9cmqw6x/

Behaviour

Suspicious behavior: EnumeratesProcesses

IcedID First Stage Loader

IcedID, BokBot

Malware Config

C2 Extraction:

oceanwaterfree34.xyz

Unpacked files

SH256 hash:

0e83c4eaf4cb50e296bab7738221164b6866ec623d7fee90382c0cc2587c4464

MD5 hash:

949378220efeb4a2ffb96367e4fd9e98

SHA1 hash:

5b174df7f8e21bebc47da1594cb6524252226c84

Link:

https://www.unpac.me/results/673f588e-4f9f-4fd1-b704-024cc4f4a49c/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

0.80

Link:

https://yomi.yoroi.company/submissions/0e83c4eaf4cb50e296bab7738221164b6866ec623d7fee90382c0cc2587c4464

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	crime_win32_icedid_stage1 Create hunting rule
Author:	Rony (@r0ny_123)
Description:	Detects IcedID Photoloader
Reference:	https://sysopfb.github.io/malware,/icedid/2020/04/28/IcedIDs-updated-photoloader.html