MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 14d20132b72f71aa405b34060416c574a3412be2e5f5b027a19d2ae3683e86c5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


IcedID


Vendor detections: 9


Intelligence 9 IOCs 1 YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 14d20132b72f71aa405b34060416c574a3412be2e5f5b027a19d2ae3683e86c5
SHA3-384 hash: 31876a6bc050ee35922dc44c0b0f9d5c31eccf3c42d55573948d71f555ac45c01543fa643e5cf9c5b515723e4aeb1302
SHA1 hash: d5ae23e24c7a43c15c3fb489c55035a6e42dd650
MD5 hash: c2d755858109c26566f7efcc2929201b
humanhash: queen-mike-paris-timing
File name:c2d755858109c26566f7efcc2929201b.dll
Download: download sample
Signature IcedID
Create hunting rule
File size:614'400 bytes
First seen:2022-06-18 15:06:07 UTC
Last seen:2022-06-18 15:31:42 UTC
File type:Executable exe
MIME type:application/x-dosexec
ssdeep 12288:k0s2tpsfoVvnMDvlDDw+DhSj3nQIyzvadokr2EnB/6bQT9YofWHKfugOM:k09WAyDtE+D4j9yzvS/LnByWHOHWuPM
Threatray 308 similar samples on MalwareBazaar
TLSH T197D4BFB875047DE6A67F467BCA96BDDD13B627629A87A4CD8064B7C305A3331FF02804
TrID 33.6% (.EXE) OS/2 Executable (generic) (2029/13)
33.1% (.EXE) Generic Win/DOS Executable (2002/3)
33.1% (.EXE) DOS Executable Generic (2000/1)
Reporter abuse_ch
Tags:dll exe IcedID


Avatar
abuse_ch
IcedID C2:
didojanza.com

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
didojanza.com https://threatfox.abuse.ch/ioc/699414/

Intelligence

File Origin
# of uploads :
2
# of downloads :
288
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
14d20132b72f71aa405b34060416c574a3412be2e5f5b027a19d2ae3683e86c5.zip
Verdict:
Suspicious activity
Analysis date:
2022-06-18 21:10:27 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/4d30a154-e294-4ef6-85e2-6c05b5e0117a

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/281173/
Detection(s):
SecuriteInfo.com.Variant.Cerbu.144796.3936.24357.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
cerbu icedid packed
Link:
https://www.filescan.io/uploads/62adea180200c8597b351f54/reports/a2a03cc3-785f-47e9-9475-76bf430d6e9d/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/49d854f5-d707-4f1a-acd8-9e9c05f81987
Result
Threat name:
IcedID
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1015696
Signature
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Contains functionality to detect hardware virtualization (CPUID execution measurement)
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
System process connects to network (likely due to code injection or exploit)
Tries to detect virtualization through RDTSC time measurements
Yara detected IcedID
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/14d20132b72f71aa405b34060416c574a3412be2e5f5b027a19d2ae3683e86c5/
Threat name:
Win64.Trojan.IcedID
Create hunting rule
Status:
Malicious
First seen:
2022-06-16 14:37:16 UTC
File Type:
PE+ (Dll)
Extracted files:
1
AV detection:
17 of 26 (65.38%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ctjacmvxf5y2uqc3gqdaifwfosruck7c4x23aj5btuvog2b6q3cq._file
Verdict:
malicious
Label(s):
icedid
Create hunting rule
Similar samples:
0581f0bf260a11a5662d58b99a82ec756c9365613833bce8f102ec1235a7d4f7
IcedID
0a497cdeb92189e1611c15669897de70e8aed2be2484346686252bea387abfa4
IcedID
14d20132b72f71aa405b34060416c574a3412be2e5f5b027a19d2ae3683e86c5
IcedID
3dfe63d2c9a7e2f848d2f92171cc577158318b4e9cb62e74ec603be84ba13109
IcedID
4b312a119321503383fbf9aaf65659046656096a7551d5a581f5cbb0055493c3
IcedID
670790c8b4649865ef391bac63417c00ffbaa203c5df36d6c9720832b0949dcb
IcedID
a746ab385c513d0f73076ed4f83ac9e4e286ca7a8e5d6a5a4f0062026039b265
IcedID
ed43bf5aa70a4f9181b57649f9cd7f0b50f0db3bc83b98ccdc94c1112be05d71
IcedID
+ 298 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/220618-shavwscba8/
Unpacked files
SH256 hash:
4a4d7cf3bfff4c2c46727169e08dbe669b2e451b530511882cda00606c4e7474
MD5 hash:
1c17fe6177ff46aff865b6d675226bdf
SHA1 hash:
3240984f74672953985f36e3ac1b2ef6b3313971
Detections:
win_photoloader_auto
Create hunting rule
win_photoloader_a0
Create hunting rule
Link:
https://www.unpac.me/results/8583fcfc-c84f-4ff1-aa16-a7e8d639006f/
Parent samples :
a29dd1e5e365ef6dd13a26ed08311c1a5436cd8fcb5f837c1826b2805e70b0b4
b3b19214a3357658687eabfb159176d5c223ca1a80fd642a3ebf218decc7a748
9eec70034e7e1a0fceda35bfab123ecef7baa719f5d23224b236983cf1b95659
9719165831438c3255b81edd50f1d9473a57b06e9794f9f0d099fc78582f7779
ed43bf5aa70a4f9181b57649f9cd7f0b50f0db3bc83b98ccdc94c1112be05d71
9b2860852604f0d78f1dfc8e42a01cc3496eb3b6da2cc5cfaf9c3b92d82b69ca
8603f8be48712ce018191f5f8d8f32003f16c286876866aa61e701fc198c9a78
dd636623af52a3708dc43af228ff5bd12f874acb6d9be92ed58642c515ba8fe2
1a9b3d506e58c53448e784a61849bcdb6494ba427f7bedbed6b887f1586aac7e
8190716008970cc6de36035ad1c403e833ba1f2b573cbf0eee723558783d2065
59442e454336e739c1e698e97b524973803300ce32b3d671e65c64e9b8032800
20f825cd68b183f9ce5dd3448e75b48a935eb51b077edb6dd595ea388b75b0a3
1f84e1d59a892c266ae192aaad311d4b66671f5bf7ce7029bd902a4859bb3e12
283cf54e73056f4e644496d2a9bf4fc61a0fca4379ffbd1543da371d5df6320d
14d20132b72f71aa405b34060416c574a3412be2e5f5b027a19d2ae3683e86c5
SH256 hash:
14d20132b72f71aa405b34060416c574a3412be2e5f5b027a19d2ae3683e86c5
MD5 hash:
c2d755858109c26566f7efcc2929201b
SHA1 hash:
d5ae23e24c7a43c15c3fb489c55035a6e42dd650
Link:
https://www.unpac.me/results/8583fcfc-c84f-4ff1-aa16-a7e8d639006f/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/14d20132b72f71aa405b34060416c574a3412be2e5f5b027a19d2ae3683e86c5

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:SPLCrypt
Create hunting rule
Author:James Quinn, Binary Defense
Description:Identifies SPLCrypt, a new crypter associated with Bazaloader

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/281173/

Comments