MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3f2c7f661e8613d8fde12919afa48c3a2f931926406327409941d31081031b62. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


IcedID


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3f2c7f661e8613d8fde12919afa48c3a2f931926406327409941d31081031b62
SHA3-384 hash: 7ff6fcb60d6958b84d9ec5a8b854aadd88b460b51d14c218c17772114de777037d852e3daa8852c7d7beedefe2287a37
SHA1 hash: 31ed1b339cc2af59af659caef06569ae9a471a0d
MD5 hash: 1783320b1641f0735cf93a8483a6b43a
humanhash: happy-monkey-sink-timing
File name:unt13.bin
Download: download sample
Signature IcedID
Create hunting rule
File size:200'704 bytes
First seen:2020-07-23 17:50:39 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash 7c1f113f29efecc9d6def6c7b4072843 (2 x IcedID)
ssdeep 3072:SEKSeiJvJ/LLKjaVkUrCYxLjtao+i9+NKTGTan:S1uJ3AaVlVHaomKG
TLSH 5C14AF0071C1C876EA4F037E8862DB35562B78598FB9D6C77BC49E8E5F761E19B32202
Reporter malware_traffic
Tags:dll IcedID

Intelligence

File Origin
# of uploads :
1
# of downloads :
101
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/31917/
Detection(s):
PUA.Win.Packer.PrivateExeProte-11
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Sending a custom TCP request
Result
Threat name:
IcedID
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
72 / 100
Link:
https://www.joesandbox.com/analysis/396650
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/3f2c7f661e8613d8fde12919afa48c3a2f931926406327409941d31081031b62/
Threat name:
Win32.Worm.Cridex
Create hunting rule
Status:
Malicious
First seen:
2020-07-23 17:52:06 UTC
AV detection:
21 of 29 (72.41%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=h4wh6zq6qyj5r7pbfem27jemhixzggjgibrsoqezihjrbaiddnra._file
Verdict:
unknown
Result
Malware family:
n/a
Score:
  8/10
Tags:
n/a
Link:
https://tria.ge/reports/200723-63qjwxxe1s/
Behaviour
Modifies system certificate store
Suspicious use of WriteProcessMemory
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Blacklisted process makes network request
Blacklisted process makes network request
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
ursnif3
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/3f2c7f661e8613d8fde12919afa48c3a2f931926406327409941d31081031b62

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/31917/

Comments