MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1a9b3d506e58c53448e784a61849bcdb6494ba427f7bedbed6b887f1586aac7e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


IcedID


Vendor detections: 7


Intelligence 7 IOCs 1 YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1a9b3d506e58c53448e784a61849bcdb6494ba427f7bedbed6b887f1586aac7e
SHA3-384 hash: a7df6d98f7873f0ed5c8015bc7db0d4efb094719a172e8da27a63349b8942158cd2b18486a5c9e4e7fb885a3a4764d13
SHA1 hash: bde1854766b9ce6f7d4d19eca8c32213c1a39284
MD5 hash: 8c739f87bab9691cf57a45d41f49690a
humanhash: comet-robin-hotel-wisconsin
File name:8c739f87bab9691cf57a45d41f49690a.dll
Download: download sample
Signature IcedID
Create hunting rule
File size:614'400 bytes
First seen:2022-06-18 07:06:37 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
ssdeep 12288:sYldoSYW7bMLxiVhUeim1ZZxqgroRNIj2ce/epyzHfTJ2I91ajZ:HldoSYW7WGURYrxqGiij2ceGIzHrJnfe
TLSH T100D4B0B875047DD6AA7E477BCD96ADE813B627628EC7A4CD806877C305B3375EE02804
TrID 33.6% (.EXE) OS/2 Executable (generic) (2029/13)
33.1% (.EXE) Generic Win/DOS Executable (2002/3)
33.1% (.EXE) DOS Executable Generic (2000/1)
Reporter abuse_ch
Tags:dll exe IcedID


Avatar
abuse_ch
IcedID C2:
didojanza.com

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
didojanza.com https://threatfox.abuse.ch/ioc/699414/

Intelligence

File Origin
# of uploads :
1
# of downloads :
269
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/281097/
Detection(s):
Win.Packed.Cerbu-9952362-0
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Sending a custom TCP request
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/62ad79b2745ae0fa14f41415/reports/b210996d-6f90-42b1-8330-220b11b4431f/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/b7aaebd7-59db-4de8-aa1d-7f9ea498da6b
Result
Threat name:
IcedID
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1015545
Signature
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Contains functionality to detect hardware virtualization (CPUID execution measurement)
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
System process connects to network (likely due to code injection or exploit)
Tries to detect virtualization through RDTSC time measurements
Yara detected IcedID
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/1a9b3d506e58c53448e784a61849bcdb6494ba427f7bedbed6b887f1586aac7e/
Threat name:
Win64.Trojan.IcedID
Create hunting rule
Status:
Malicious
First seen:
2022-06-16 14:30:16 UTC
File Type:
PE+ (Dll)
Extracted files:
1
AV detection:
19 of 26 (73.08%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=dknt2udoldctishhqstbqsn43nsjjoscp5563pwwxcd7cwdkvr7a._file
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/220618-hxmswshhe9/
Unpacked files
SH256 hash:
4a4d7cf3bfff4c2c46727169e08dbe669b2e451b530511882cda00606c4e7474
MD5 hash:
1c17fe6177ff46aff865b6d675226bdf
SHA1 hash:
3240984f74672953985f36e3ac1b2ef6b3313971
Detections:
win_photoloader_auto
Create hunting rule
win_photoloader_a0
Create hunting rule
Link:
https://www.unpac.me/results/d2337e32-5fc4-4444-8625-eef701a8dcd8/
Parent samples :
a29dd1e5e365ef6dd13a26ed08311c1a5436cd8fcb5f837c1826b2805e70b0b4
b3b19214a3357658687eabfb159176d5c223ca1a80fd642a3ebf218decc7a748
9eec70034e7e1a0fceda35bfab123ecef7baa719f5d23224b236983cf1b95659
9719165831438c3255b81edd50f1d9473a57b06e9794f9f0d099fc78582f7779
ed43bf5aa70a4f9181b57649f9cd7f0b50f0db3bc83b98ccdc94c1112be05d71
9b2860852604f0d78f1dfc8e42a01cc3496eb3b6da2cc5cfaf9c3b92d82b69ca
8603f8be48712ce018191f5f8d8f32003f16c286876866aa61e701fc198c9a78
dd636623af52a3708dc43af228ff5bd12f874acb6d9be92ed58642c515ba8fe2
1a9b3d506e58c53448e784a61849bcdb6494ba427f7bedbed6b887f1586aac7e
8190716008970cc6de36035ad1c403e833ba1f2b573cbf0eee723558783d2065
59442e454336e739c1e698e97b524973803300ce32b3d671e65c64e9b8032800
20f825cd68b183f9ce5dd3448e75b48a935eb51b077edb6dd595ea388b75b0a3
1f84e1d59a892c266ae192aaad311d4b66671f5bf7ce7029bd902a4859bb3e12
283cf54e73056f4e644496d2a9bf4fc61a0fca4379ffbd1543da371d5df6320d
14d20132b72f71aa405b34060416c574a3412be2e5f5b027a19d2ae3683e86c5
SH256 hash:
1a9b3d506e58c53448e784a61849bcdb6494ba427f7bedbed6b887f1586aac7e
MD5 hash:
8c739f87bab9691cf57a45d41f49690a
SHA1 hash:
bde1854766b9ce6f7d4d19eca8c32213c1a39284
Link:
https://www.unpac.me/results/d2337e32-5fc4-4444-8625-eef701a8dcd8/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/1a9b3d506e58c53448e784a61849bcdb6494ba427f7bedbed6b887f1586aac7e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:SPLCrypt
Create hunting rule
Author:James Quinn, Binary Defense
Description:Identifies SPLCrypt, a new crypter associated with Bazaloader

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/281097/

Comments