🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0ed6e961a7bcebf37764de044209710dc23a004a9e2e51fe8e778df87e64819b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


IcedID


Vendor detections: 12


Intelligence 12 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0ed6e961a7bcebf37764de044209710dc23a004a9e2e51fe8e778df87e64819b
SHA3-384 hash: 55665ebac0ea9ce53412f37d3378bcb71c97a6f62d72cc8639364904f0a56d03e00d08f0f62c294918be05b0cd8e0dc4
SHA1 hash: f9911bbd98816cb29d03780e4f749cbd876b2f7e
MD5 hash: 3e849d9099875258dd84050b9ea2623c
humanhash: georgia-zebra-pasta-mirror
File name:b73f8697
Download: download sample
Signature IcedID
Create hunting rule
File size:37'307 bytes
First seen:2022-04-19 18:01:57 UTC
Last seen:2022-04-19 20:14:49 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash b7c3df2710e6ac04818e0e6c3bc1d99e (1 x IcedID)
ssdeep 768:hjcfgqlLYzjOdoXbL4JvF2tlWDhcE1LMrgmI/+YkdhdsMd:hjslsGIb8vKWLQMVNk/dF
Threatray 654 similar samples on MalwareBazaar
TLSH T166F25B6A5BF8F6A3F293E8325B391505E07BBB824F295097BD01031E4579EE3C833656
TrID 38.8% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
20.5% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5)
13.0% (.EXE) Win64 Executable (generic) (10523/12/4)
8.1% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
6.2% (.EXE) Win16 NE executable (generic) (5038/12/1)
Reporter Anonymous
Tags:exe IcedID

Intelligence

File Origin
# of uploads :
3
# of downloads :
383
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
MDE_File_Sample_f9911bbd98816cb29d03780e4f749cbd876b2f7e.zip
Verdict:
Malicious activity
Analysis date:
2022-04-19 17:42:08 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/fcb78a11-688d-4d76-8d96-9248ac5c44f5

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
IcedIDLoader
Create hunting rule
Link:
https://www.capesandbox.com/analysis/264679/
Detection(s):
SecuriteInfo.com.DeepScan.Generic.Exploit.Shellcode.RDI.1.8FCA8E63.5119.21331.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
DNS request
Sending a custom TCP request
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
emotet exploit mshta.exe overlay packed trickbot
Link:
https://www.filescan.io/uploads/625ef925eab80a7a6c438dda/reports/4dbaa5eb-8be9-4d6e-a89c-5cb01dc24663/overview
Malware family:
IcedID
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/e29f8338-22cf-43ec-a80a-02d90e449070
Result
Threat name:
IcedID
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
76 / 100
Link:
https://www.joesandbox.com/analysis/979037
Signature
Contains functionality to detect hardware virtualization (CPUID execution measurement)
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Yara detected IcedID
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0ed6e961a7bcebf37764de044209710dc23a004a9e2e51fe8e778df87e64819b/
Threat name:
Win32.Trojan.TrickBot
Create hunting rule
Status:
Malicious
First seen:
2020-05-14 18:22:54 UTC
File Type:
PE (Exe)
Extracted files:
1
AV detection:
21 of 26 (80.77%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=b3losynhxtv7g53e3yceeclrbxbduacktyxfd7uoo6g7q7teqgnq._file
Verdict:
malicious
Label(s):
icedid
Create hunting rule
Similar samples:
1fbede7e5ad40bf07aec1ad11f6fc4203c2cf2236c95dd5e81be4c742166054a
IcedID
33ee572238490c5fb2b183ebcbeeb67602dd1578aa2b8a4d189a735adc82d101
IcedID
7be97a8a8b5d1998868aeff9f0deba54482cd4c0d220423ed1f0ae3eb1442c27
IcedID
8b282e9e0af37774a537540971ffc1aa49fffc3279d630bf11cd7a3ef54083f0
IcedID
932cbb5b3404052ae7865de3dda0a93c6906f83cfa3adaad3e027ceba2233b28
IcedID
9855e6cab6dc7b89aa792aafd85bf39ac186954964427fc6e4c236a0a613d8e4
IcedID
b16be1a60cfaee5eee0df3fde99ee17bbe6ee3a32de4b4786492966f4c006193
IcedID
b742590b8b2d11205f4993f167f602b7f47b8ac07d5661bfd2ac336c9e7d750d
IcedID
c6fb63b8f9923126a10d8cdc2f8cdd5fb0ac2b5c76ffe41d8618f16097f31fce
IcedID
e13cd3e0597f4b7a641177eb56d8b1302490c06472a344d1663cd319fcae58cf
IcedID
+ 644 additional samples on MalwareBazaar
Result
Malware family:
icedid
Create hunting rule
Score:
  10/10
Tags:
family:icedid banker loader trojan
Link:
https://tria.ge/reports/220419-wme7ysfhhj/
Behaviour
IcedID First Stage Loader
IcedID, BokBot
Malware Config
C2 Extraction:
dekeoipsi.top
Unpacked files
SH256 hash:
f020d43da6af8a072108dbb35b0a52b3c824eb9085929b60055cf9be72dec65b
MD5 hash:
9e3891a3044738b5ceb6199040e038ea
SHA1 hash:
6eece915d033c47ed43768797b17ba895255b41d
Link:
https://www.unpac.me/results/e114252e-0e17-46ae-8d1e-d7698e11fe84/
SH256 hash:
0ed6e961a7bcebf37764de044209710dc23a004a9e2e51fe8e778df87e64819b
MD5 hash:
3e849d9099875258dd84050b9ea2623c
SHA1 hash:
f9911bbd98816cb29d03780e4f749cbd876b2f7e
Link:
https://www.unpac.me/results/e114252e-0e17-46ae-8d1e-d7698e11fe84/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/0ed6e961a7bcebf37764de044209710dc23a004a9e2e51fe8e778df87e64819b

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:crime_win32_icedid_stage1
Create hunting rule
Author:Rony (@r0ny_123)
Description:Detects IcedID photoloader
Reference:https://sysopfb.github.io/malware,/icedid/2020/04/28/IcedIDs-updated-photoloader.html
Rule name:IcedIDLoader
Create hunting rule
Author:kevoreilly, threathive, enzo
Description:IcedID Loader
Rule name:IcedIDStage1
Create hunting rule
Author:kevoreilly, threathive, enzo
Description:IcedID Payload
Rule name:IcedID_init_loader
Create hunting rule
Author:@bartblaze
Description:Identifies IcedID (stage 1 and 2, initial loaders).
Rule name:win_photoloader_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.photoloader.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/264679/

Comments