🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1ff6aefc4e45ece0e3cc73e02d3dd463bb4fe1d2101b1b1af0fbfb97318264f9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


IcedID


Vendor detections: 13


Intelligence 13 IOCs 1 YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1ff6aefc4e45ece0e3cc73e02d3dd463bb4fe1d2101b1b1af0fbfb97318264f9
SHA3-384 hash: e8d106d8de56b7da2d040129cff70c203c00cc03b4941e06c73fcee4ea9ecf5f793b31f79868633f12d69bc83900dd70
SHA1 hash: 97aaa94d8b3d4f1b56a21429a10e3f27e115b180
MD5 hash: 2acf6b06d8a6aba42d2829b886c8e801
humanhash: romeo-bulldog-sodium-floor
File name:2acf6b06d8a6aba42d2829b886c8e801.exe
Download: download sample
Signature IcedID
Create hunting rule
File size:152'012 bytes
First seen:2022-09-29 22:11:36 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 2eb47d2021865d3cd1d2e04d37e46259 (2 x IcedID)
ssdeep 1536:1gkpq7SF0ivbmqBrUNzeNLwnAMzPO3YI2Tmogeg+aMzPz8ZUvMWHnTX9ZSk1kyIE:1gUsivhrUYNMGIRFg+a28VeTVw2iBk
TLSH T1BDE34D87AF99DCAAD901033A0CD98314173AF2A09B434F172E3565364E63BD4BFD725A
TrID 43.3% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5)
27.5% (.EXE) Win64 Executable (generic) (10523/12/4)
13.2% (.EXE) Win16 NE executable (generic) (5038/12/1)
5.3% (.EXE) OS/2 Executable (generic) (2029/13)
5.2% (.EXE) Generic Win/DOS Executable (2002/3)
Reporter abuse_ch
Tags:exe IcedID


Avatar
abuse_ch
IcedID C2:
ranmilokd.com

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
ranmilokd.com https://threatfox.abuse.ch/ioc/858592/

Intelligence

File Origin
# of uploads :
1
# of downloads :
350
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/314978/
Detection(s):
SecuriteInfo.com.Trojan.IcedID.84.27598.24422.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
DNS request
Sending an HTTP GET request
Result
Malware family:
n/a
Score:
  8/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/40083/overview
Behaviour
MalwareBazaar
SystemUptime
MeasuringTime
EvasionQueryPerformanceCounter
EvasionGetTickCount
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
anti-debug anti-vm icedid overlay packed sc.exe spyeye
Link:
https://www.filescan.io/uploads/6336183478d4acb349f37837/reports/73dbd8ef-7d01-4018-a4c0-c164e85ade18/overview
Malware family:
IcedID
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/23b7f49c-ad8a-4b80-afa7-ca033595756d
Result
Threat name:
IcedID
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
84 / 100
Link:
https://www.joesandbox.com/analysis/1080524
Signature
C2 URLs / IPs found in malware configuration
Contains functionality to detect hardware virtualization (CPUID execution measurement)
Found API chain indicative of debugger detection
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Tries to detect virtualization through RDTSC time measurements
Yara detected IcedID
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/1ff6aefc4e45ece0e3cc73e02d3dd463bb4fe1d2101b1b1af0fbfb97318264f9/
Threat name:
Win64.Trojan.IcedID
Create hunting rule
Status:
Malicious
First seen:
2022-09-27 17:08:00 UTC
File Type:
PE+ (Exe)
AV detection:
19 of 26 (73.08%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=d73k57coixwoby6mopqc2poumo5u7yoscanrwgxq7p5zommcmt4q._file
Verdict:
malicious
Label(s):
icedid
Create hunting rule
Result
Malware family:
icedid
Create hunting rule
Score:
  10/10
Tags:
family:icedid campaign:1384743275 banker loader trojan
Link:
https://tria.ge/reports/220929-14g54adabm/
Behaviour
Suspicious behavior: EnumeratesProcesses
IcedID, BokBot
Malware Config
C2 Extraction:
ranmilokd.com
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/2b55e3c5-489d-4f7c-9115-7c68773bbe33
Unpacked files
SH256 hash:
1ff6aefc4e45ece0e3cc73e02d3dd463bb4fe1d2101b1b1af0fbfb97318264f9
MD5 hash:
2acf6b06d8a6aba42d2829b886c8e801
SHA1 hash:
97aaa94d8b3d4f1b56a21429a10e3f27e115b180
Link:
https://www.unpac.me/results/0940dcdd-eb4e-4679-8352-4ddd9cc015e9/
Malware family:
IcedID
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/1ff6aefc4e45/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/1ff6aefc4e45ece0e3cc73e02d3dd463bb4fe1d2101b1b1af0fbfb97318264f9

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:crime_win32_icedid_stage1
Create hunting rule
Author:Rony (@r0ny_123)
Description:Detects IcedID photoloader
Reference:https://sysopfb.github.io/malware,/icedid/2020/04/28/IcedIDs-updated-photoloader.html
Rule name:IcedIDLoader
Create hunting rule
Author:kevoreilly, threathive, enzo
Description:IcedID Loader
Rule name:IcedID_init_loader
Create hunting rule
Author:@bartblaze
Description:Identifies IcedID (stage 1 and 2, initial loaders).
Rule name:MALWARE_Win_IceID
Create hunting rule
Author:ditekSHen
Description:Detects IceID / Bokbot variants
Rule name:win_photoloader_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.photoloader.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/314978/

Comments