🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 10555c8b990ea7b099d81e004e88dfc141ec60aae5648863293c86c43bb70bc8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


IcedID


Vendor detections: 5


Intelligence 5 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 10555c8b990ea7b099d81e004e88dfc141ec60aae5648863293c86c43bb70bc8
SHA3-384 hash: b9323b842d943c4243def7bbade8a45516bd72cb3ecf7117e35fd2b54d0ac1b5fac24262f7c8fb38de3146ce1b933ad0
SHA1 hash: 6240ed59602063e0aceb353fbd04a3cba8bb072a
MD5 hash: 57597c856565e3300252ceb30c82e49b
humanhash: batman-may-august-blue
File name:Invoice#5756.html
Download: download sample
Signature IcedID
Create hunting rule
File size:476'072 bytes
First seen:2022-10-12 14:56:45 UTC
Last seen:Never
File type: html
MIME type:text/html
ssdeep 12288:YoAK3Yx3JSxcYh/AghVum2fVqAAVlbLSohMDRQ1PmTm7O:vfc5SRUME
TLSH T1C8A402919DAAC488DF3C62E53D9F4C4D372841E016688DC72A55FCA9BE49F3E604F68C
TrID 62.5% (.SMI/SMIL) Synchronized Multimedia Integration Language (5001/2/2)
37.4% (.HTML) HyperText Markup Language (3000/1/1)
Reporter k3dg3___
Tags:342850082 html IcedID pw W485


Avatar
k3dg3
C2: tracksupernova.com
Project ID: 342850082

Intelligence

File Origin
# of uploads :
1
# of downloads :
228
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.GenericKD.62713814.2873.11694.UNOFFICIAL
Create hunting rule

Verdict:
No Threat
Threat level:
  2/10
Confidence:
75%
Tags:
stealer
Link:
https://www.filescan.io/uploads/6346d5bf41e73408834eab33/reports/5d5a3abb-5cca-40e6-ba5b-90c925aed8b2/overview
Result
Threat name:
HtmlDropper, IcedID
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1088901
Signature
C2 URLs / IPs found in malware configuration
Contains functionality to detect hardware virtualization (CPUID execution measurement)
Drops PE files to the user root directory
Drops PE files with a suspicious file extension
HTML document with suspicious name
Malicious sample detected (through community Yara rule)
Sigma detected: Execute DLL with spoofed extension
System process connects to network (likely due to code injection or exploit)
Tries to detect virtualization through RDTSC time measurements
Uses 7zip to decompress a password protected archive
Yara detected Html Dropper
Yara detected IcedID
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 721506 Sample: Invoice#5756.html Startdate: 12/10/2022 Architecture: WINDOWS Score: 100 58 Malicious sample detected (through community Yara rule) 2->58 60 Yara detected Html Dropper 2->60 62 Yara detected IcedID 2->62 64 3 other signatures 2->64 9 chrome.exe 18 8 2->9         started        12 chrome.exe 2->12         started        process3 dnsIp4 52 192.168.2.1 unknown unknown 9->52 54 192.168.2.3 unknown unknown 9->54 56 239.255.255.250 unknown Reserved 9->56 14 unarchiver.exe 5 9->14         started        17 chrome.exe 9->17         started        process5 dnsIp6 76 Uses 7zip to decompress a password protected archive 14->76 20 cmd.exe 2 14->20         started        23 cmd.exe 1 14->23         started        26 7za.exe 2 14->26         started        44 clients.l.google.com 142.250.184.206, 443, 49696 GOOGLEUS United States 17->44 46 www.google.com 142.250.186.36, 443, 49700, 49733 GOOGLEUS United States 17->46 48 3 other IPs or domains 17->48 signatures7 process8 file9 42 C:\Users\user\admin.com, PE32 20->42 dropped 28 rundll32.exe 20->28         started        30 conhost.exe 1 20->30         started        66 Drops PE files to the user root directory 23->66 68 Drops PE files with a suspicious file extension 23->68 32 powershell.exe 36 23->32         started        34 conhost.exe 23->34         started        36 conhost.exe 26->36         started        signatures10 process11 process12 38 rundll32.exe 28->38         started        dnsIp13 50 tracksupernova.com 104.248.81.57, 49723, 49724, 49725 DIGITALOCEAN-ASNUS United States 38->50 70 System process connects to network (likely due to code injection or exploit) 38->70 72 Contains functionality to detect hardware virtualization (CPUID execution measurement) 38->72 74 Tries to detect virtualization through RDTSC time measurements 38->74 signatures14
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/10555c8b990ea7b099d81e004e88dfc141ec60aae5648863293c86c43bb70bc8/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=cbkvzc4zb2t3bgoydyae5cg7yfa6yyfk4vsiqyzjhsdmio5xbpea._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
IcedID
Score:
0.90
Link:
https://yomi.yoroi.company/submissions/10555c8b990ea7b099d81e004e88dfc141ec60aae5648863293c86c43bb70bc8

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:BitcoinAddress
Create hunting rule
Author:Didier Stevens (@DidierStevens)
Description:Contains a valid Bitcoin address
Rule name:QbotStuff
Create hunting rule
Author:anonymous

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

IcedID

html 10555c8b990ea7b099d81e004e88dfc141ec60aae5648863293c86c43bb70bc8

(this sample)

  
Delivery method
Distributed via e-mail attachment

Comments