MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3839ea5f86c4ebc8036ab26cfee2b0e05893a6b276d39ba23b75980c4db4c8a4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


IcedID


Vendor detections: 8


Intelligence 8 IOCs 1 YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3839ea5f86c4ebc8036ab26cfee2b0e05893a6b276d39ba23b75980c4db4c8a4
SHA3-384 hash: ee75080c169265b6574483b213fd8a9a4015a8f6d7f7d7c715677a814de6dd3f38196beaeef5473c9c24ba242dc6571c
SHA1 hash: 725c29b02c040ec7fa3f5790716073f3ede3e0c2
MD5 hash: b22c0344515fb985100a02f0e3bb5845
humanhash: stream-xray-fifteen-freddie
File name:725c29b02c040ec7fa3f5790716073f3ede3e0c2.dll
Download: download sample
Signature IcedID
Create hunting rule
File size:86'528 bytes
First seen:2021-06-21 09:26:30 UTC
Last seen:2021-06-21 09:42:16 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 6859c1fbd5011b39e2b3c5ccd6eda491 (2 x IcedID, 2 x Kimsuky, 1 x BazaLoader)
ssdeep 1536:I3Q/6OpeJ3iNXz+jyJnGSzgNemxTlytbbGy5olhBMDFMQexew6dwM01P:0ApeJSNXCCPGxTMwy5o8Fnp5
Threatray 143 similar samples on MalwareBazaar
TLSH 308302CA676EABE3C5DE683771686374D0B1614E8BD5F0860584D7DCB78B532683B340
Reporter abuse_ch
Tags:dll exe IcedID


Avatar
abuse_ch
IcedID C2:
bethehill.trade

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
bethehill.trade https://threatfox.abuse.ch/ioc/138146/

Intelligence

File Origin
# of uploads :
2
# of downloads :
513
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
725c29b02c040ec7fa3f5790716073f3ede3e0c2.dll
Verdict:
No threats detected
Analysis date:
2021-06-21 09:29:14 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/02fe269a-09c2-47a4-a568-3741f7ae2657

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/167246/
Detection(s):
PUA.Win.Packer.Embedpe-3
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/3bc48ccd-08ca-4ed9-b692-36b12d58b34f
Result
Threat name:
IcedID
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
72 / 100
Link:
https://www.joesandbox.com/analysis/805224
Signature
Contains functionality to detect hardware virtualization (CPUID execution measurement)
Multi AV Scanner detection for submitted file
System process connects to network (likely due to code injection or exploit)
Tries to detect virtualization through RDTSC time measurements
Yara detected IcedID
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 437635 Sample: SOAOG31JdG.dll Startdate: 21/06/2021 Architecture: WINDOWS Score: 72 28 clientconfig.passport.net 2->28 62 Multi AV Scanner detection for submitted file 2->62 64 Yara detected IcedID 2->64 8 loaddll64.exe 1 2->8         started        signatures3 process4 dnsIp5 42 bethehill.trade 8->42 44 tp.8e49140c2-frontier.amazon.com 8->44 46 2 other IPs or domains 8->46 72 Contains functionality to detect hardware virtualization (CPUID execution measurement) 8->72 74 Tries to detect virtualization through RDTSC time measurements 8->74 12 cmd.exe 1 8->12         started        14 regsvr32.exe 8->14         started        18 rundll32.exe 8->18         started        20 18 other processes 8->20 signatures6 process7 dnsIp8 22 rundll32.exe 12->22         started        48 bethehill.trade 172.67.189.142, 49699, 49704, 49712 CLOUDFLARENETUS United States 14->48 50 dr49lng3n1n2s.cloudfront.net 13.225.75.73, 443, 49695, 49696 AMAZON-02US United States 14->50 56 2 other IPs or domains 14->56 76 Contains functionality to detect hardware virtualization (CPUID execution measurement) 14->76 78 Tries to detect virtualization through RDTSC time measurements 14->78 58 2 other IPs or domains 18->58 80 System process connects to network (likely due to code injection or exploit) 18->80 52 192.168.2.1 unknown unknown 20->52 54 tp.8e49140c2-frontier.amazon.com 20->54 60 3 other IPs or domains 20->60 26 iexplore.exe 5 156 20->26         started        signatures9 process10 dnsIp11 30 bethehill.trade 22->30 32 tp.8e49140c2-frontier.amazon.com 22->32 38 2 other IPs or domains 22->38 66 System process connects to network (likely due to code injection or exploit) 22->66 68 Contains functionality to detect hardware virtualization (CPUID execution measurement) 22->68 70 Tries to detect virtualization through RDTSC time measurements 22->70 34 tls13.taboola.map.fastly.net 151.101.1.44, 443, 49736, 49737 FASTLYUS United States 26->34 36 geolocation.onetrust.com 104.20.184.68, 443, 49718, 49719 CLOUDFLARENETUS United States 26->36 40 8 other IPs or domains 26->40 signatures12
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/3839ea5f86c4ebc8036ab26cfee2b0e05893a6b276d39ba23b75980c4db4c8a4/
Threat name:
Win64.Trojan.IcedID
Create hunting rule
Status:
Malicious
First seen:
2021-06-18 01:03:57 UTC
AV detection:
17 of 29 (58.62%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ha46ux4gytv4qa3kwjwp5yvq4bmjhjvso3jzxir3owmaytnuzcsa._file
Verdict:
malicious
Label(s):
icedid
Create hunting rule
Similar samples:
172dcb63c1df471b850a8ce06fbe8343cf82de322f2944f686a682c3793d2c03
IcedID
177b312a0c7c2d03be3b2916505fb3e9fdefe785330c74ac29e89cb22656367e
IcedID
391a3345bbbfaa64e34d0dda39ecebd1057c22808270b60750f9bec97716734a
IcedID
447a0ab1979dfe2b0d3ebd7082dec8ad9fba6c8a34bef39217fa4f2c6073c5d8
IcedID
6c6939f72d85a8d97f4aa81c53d02dccca16e6deff4a2a3eb017ea374713aace
IcedID
6e3135f2b19b776522d8ea589f676d6b707eeaf112c77d88923caf15bf98eff5
IcedID
a28cead812579eacf8d58be5b5ee55adc18409499108d4f5cc98acbf92c87531
IcedID
b5f8f3ecbf1f2276024ac2590a3ab257e9aacd9a773b6cb44af57776a8a1fc1e
IcedID
e87a3aade32a0e9b09eede42d6e59ee32646adb37da99f8ae730f35582f65dc2
IcedID
f266bc35f9a52d2dc6e63fab03f8a6aab989639b9920e2afe5d2d4517340d3c9
IcedID
+ 133 additional samples on MalwareBazaar
Result
Malware family:
icedid
Create hunting rule
Score:
  10/10
Tags:
family:icedid campaign:942942329 banker trojan
Link:
https://tria.ge/reports/210621-gbvfpsplxe/
Behaviour
Suspicious behavior: EnumeratesProcesses
IcedID, BokBot
Unpacked files
SH256 hash:
3839ea5f86c4ebc8036ab26cfee2b0e05893a6b276d39ba23b75980c4db4c8a4
MD5 hash:
b22c0344515fb985100a02f0e3bb5845
SHA1 hash:
725c29b02c040ec7fa3f5790716073f3ede3e0c2
Link:
https://www.unpac.me/results/19689d45-df9d-480f-870d-b8dd342a411f/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Dropper
Score:
0.80
Link:
https://yomi.yoroi.company/submissions/3839ea5f86c4ebc8036ab26cfee2b0e05893a6b276d39ba23b75980c4db4c8a4

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:crime_win32_icedid_stage1
Create hunting rule
Author:Rony (@r0ny_123)
Description:Detects IcedID Photoloader
Reference:https://sysopfb.github.io/malware,/icedid/2020/04/28/IcedIDs-updated-photoloader.html
Rule name:IcedID
Create hunting rule
Author:@bartblaze
Description:Identifies IcedID (stage 1 and 2, loaders).
Rule name:MAL_IcedID_GZIP_LDR_202104
Create hunting rule
Author:Thomas Barabosch, Telekom Security
Description:2021 initial Bokbot / Icedid loader for fake GZIP payloads
Reference:https://www.telekom.com/en/blog/group/article/let-s-set-ice-on-fire-hunting-and-detecting-icedid-infections-627240
Rule name:suspicious_packer_section
Create hunting rule
Author:@j0sm1
Description:The packer/protector section names/keywords
Reference:http://www.hexacorn.com/blog/2012/10/14/random-stats-from-1-2m-samples-pe-section-names/
Rule name:win_iceid_gzip_ldr_202104
Create hunting rule
Author:Thomas Barabosch, Telekom Security
Description:2021 initial Bokbot / Icedid loader for fake GZIP payloads

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/167246/

Comments