🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 15e6f81e3e57d8cd9bbbb51c1d9486ea61cd2b17b0fc6288f2cf9f900f4ce985. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


IcedID


Vendor detections: 5


Intelligence 5 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 15e6f81e3e57d8cd9bbbb51c1d9486ea61cd2b17b0fc6288f2cf9f900f4ce985
SHA3-384 hash: 5605265b768a487acde2c84744fa2a0609140eff174c16a10d1bffb8ae445630c4bb8e601513c917dfe9156a3e04d14f
SHA1 hash: 42bb1415e59c000180136847f18afeb0de0f4a21
MD5 hash: ff216856aee09a4194734694f42778a1
humanhash: jersey-juliet-early-butter
File name:Files_9523_DEC-12.html
Download: download sample
Signature IcedID
Create hunting rule
File size:540'319 bytes
First seen:2022-12-12 17:01:18 UTC
Last seen:Never
File type: html
MIME type:text/html
ssdeep 12288:EnQFMEjuNS+6WWycGQsTPDm8xe7nhcBVJoAK3Yx3JSxcYH:EnQKZNt3zTq8xIyB8fc5SN
TLSH T196B42314DF28EF9D07DA068A3C5F5A60F2758DE71AB051A317D5E0D638AAB1188BBD30
Reporter k3dg3___
Tags:814709416 ewgahskoot.com html IcedID

Intelligence

File Origin
# of uploads :
1
# of downloads :
184
Origin country :
US US
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.JS.Obfus-2179.UNOFFICIAL
Create hunting rule

TwinWave.Encoder.Javascript_Obfuscator_Usage_Observed_M1.20220427.UNOFFICIAL
Create hunting rule

TwinWave.Encoder.Javascript_Obfuscator_Usage_Observed_M2.20220427.UNOFFICIAL
Create hunting rule

TwinWave.Encoder.Javascript_Obfuscator_Usage_Observed_M3.20220427.UNOFFICIAL
Create hunting rule

TwinWave.EvilHTML.QakbotTheDuck.20221013.UNOFFICIAL
Create hunting rule

Verdict:
No Threat
Threat level:
  2/10
Confidence:
100%
Link:
https://www.filescan.io/uploads/63975e8a485d8463dc41440b/reports/0a319b03-109e-4037-9791-f50dbc811b71/overview
Result
Threat name:
HtmlDropper, IcedID
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1132977
Signature
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Malicious sample detected (through community Yara rule)
System process connects to network (likely due to code injection or exploit)
Tries to detect virtualization through RDTSC time measurements
Uses 7zip to decompress a password protected archive
Yara detected Html Dropper
Yara detected IcedID
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 765700 Sample: Files_9523_DEC-12.html Startdate: 12/12/2022 Architecture: WINDOWS Score: 100 61 Malicious sample detected (through community Yara rule) 2->61 63 Antivirus detection for URL or domain 2->63 65 Yara detected Html Dropper 2->65 67 2 other signatures 2->67 9 chrome.exe 19 8 2->9         started        12 chrome.exe 2->12         started        14 udfs.sys 2->14         started        process3 dnsIp4 53 192.168.2.1 unknown unknown 9->53 55 239.255.255.250 unknown Reserved 9->55 16 unarchiver.exe 5 9->16         started        19 chrome.exe 9->19         started        process5 dnsIp6 59 Uses 7zip to decompress a password protected archive 16->59 22 cmd.exe 1 16->22         started        24 cmd.exe 1 16->24         started        26 7za.exe 2 16->26         started        47 mc.yandex.ru 87.250.250.119, 443, 49716, 49717 YANDEXRU Russian Federation 19->47 49 clients.l.google.com 142.250.185.110, 443, 49710 GOOGLEUS United States 19->49 51 6 other IPs or domains 19->51 signatures7 process8 process9 28 rundll32.exe 22->28         started        30 xcopy.exe 2 22->30         started        33 conhost.exe 1 22->33         started        35 powershell.exe 36 24->35         started        37 conhost.exe 24->37         started        39 conhost.exe 26->39         started        file10 41 rundll32.exe 28->41         started        45 C:\Users\user\AppData\...\offscouring.bin, PE32+ 30->45 dropped process11 dnsIp12 57 ewgahskoot.com 165.227.104.80, 49733, 49735, 49741 DIGITALOCEAN-ASNUS United States 41->57 69 System process connects to network (likely due to code injection or exploit) 41->69 71 Tries to detect virtualization through RDTSC time measurements 41->71 signatures13
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/15e6f81e3e57d8cd9bbbb51c1d9486ea61cd2b17b0fc6288f2cf9f900f4ce985/
Threat name:
Win32.Downloader.Nemucod
Create hunting rule
Status:
Malicious
First seen:
2022-12-12 17:02:06 UTC
File Type:
Text (HTML)
Extracted files:
7
AV detection:
4 of 40 (10.00%)
Threat level:
  3/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=cxtpqhr6k7mm3g53wuob3feg5jq42kyxwd6gfchsz6pzad2m5gcq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.26
Link:
https://yomi.yoroi.company/submissions/15e6f81e3e57d8cd9bbbb51c1d9486ea61cd2b17b0fc6288f2cf9f900f4ce985

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:BitcoinAddress
Create hunting rule
Author:Didier Stevens (@DidierStevens)
Description:Contains a valid Bitcoin address
Rule name:QbotStuff
Create hunting rule
Author:anonymous
Rule name:SUSP_obfuscated_JS_obfuscatorio
Create hunting rule
Author:@imp0rtp3
Description:Detects JS obfuscation done by the js obfuscator (often malicious)
Reference:https://obfuscator.io

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

IcedID

html 15e6f81e3e57d8cd9bbbb51c1d9486ea61cd2b17b0fc6288f2cf9f900f4ce985

(this sample)

5c4061ed08f89eaa12f61842bc2bef83d29a2727a9dcff5d445d6b2fd120cae9

  
Link
https://tria.ge/221212-vf3t1aef71/behavioral1
  
Dropping
SHA256 5c4061ed08f89eaa12f61842bc2bef83d29a2727a9dcff5d445d6b2fd120cae9
  
Delivery method
Distributed via e-mail attachment

Comments