MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2923002a04ea0e7d7aa2cb0f4bdab6baa112d2a84775230f754fa9a8c204db25. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	2923002a04ea0e7d7aa2cb0f4bdab6baa112d2a84775230f754fa9a8c204db25
SHA3-384 hash:	3e143aae775c9fd8092934955b67efecdc00e1d5d5c5a31d578ea441015bb0420cc6f66521a00f4aab8e8339e7fbeba2
SHA1 hash:	5fe41b5d9bb7f8c31539f55f45f0167ff9c14717
MD5 hash:	c15b18f51fcf0187b94038d34f4e6762
humanhash:	rugby-maine-sweet-alaska
File name:	Attach#8508.zip
Download:	download sample
Signature	IcedID Alert Create hunting rule
File size:	4'938 bytes
First seen:	2023-03-16 18:28:10 UTC
Last seen:	Never
File type:	zip
MIME type:	application/zip
Note:	This file is a password protected archive. The password is: 747
ssdeep	96:4CAh6BbbaQWNngOj4Sb4jApBwdaLWZ6JGs07M6OLzS5zWtQ0jN:4QXaQWf4S0sodGvG26O/06t3jN
TLSH	T17AA17DA732924931F203CB3C9C8DE8C0B39AE08E81494D7E25E2C315099F93E8F45ED9
TrID	80.0% (.ZIP) ZIP compressed archive (4000/1) 20.0% (.PG/BIN) PrintFox/Pagefox bitmap (640x800) (1000/1)
Reporter	proxylife
Tags:	IcedID pw-747 zip

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

157

Origin country :

US

File Archive Information

This file is a password protected archive. The password is: 747

This file archive contains 1 file(s), sorted by their relevance:

Relevant files 1

File name:	Request_5706175_March_16.js
File size:	10'350 bytes
SHA256 hash:	7dbaf1de54b48403f276746d5c7fe6e48f00258850bcf88cd089386094cd1500
MD5 hash:	c9705b07cb11434eb8c62c794ff1e4d1
MIME type:	text/plain
Signature	IcedID

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

Sanesecurity.Foxhole.Zip_fs676.UNOFFICIAL

Alert

Create hunting rule

FileScan.io

Gathering data

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/2923002a04ea0e7d7aa2cb0f4bdab6baa112d2a84775230f754fa9a8c204db25

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/2923002a04ea0e7d7aa2cb0f4bdab6baa112d2a84775230f754fa9a8c204db25/

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=ferqakqe5ihh26vczmhuxwvwxkqrfuvii52sgd3vj6u2rqqe3msq._file

Hatching Triage icedid

Result

Malware family:

icedid

Alert

Create hunting rule

Score:

  10/10

Tags:

family:icedid campaign:2171387498 banker loader trojan

Link:

https://tria.ge/reports/230316-xlcwwaef6v/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Checks computer location settings

Loads dropped DLL

Blocklisted process makes network request

Downloads MZ/PE file

IcedID, BokBot

Malware Config

C2 Extraction:

avroralikhaem.com

Dropper Extraction:

http://burisman.top/gatef1.php

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.