🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3f8e1e14a9ae69a06814eae4e7bfa221f814b6d2298e66b4850f5c416196af17. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


IcedID


Vendor detections: 5


Intelligence 5 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3f8e1e14a9ae69a06814eae4e7bfa221f814b6d2298e66b4850f5c416196af17
SHA3-384 hash: 12d10cde095c639b0c89393bbea2a7e515fd77904433543565bb0c919d4b5292c76264b55ce91740894fdfd2bc85d747
SHA1 hash: 4d1bb231b8ca6f08cdfdf47af73b228f46daa3d8
MD5 hash: 9e32b28c19ecfcad43de4fea3575fc7f
humanhash: lake-oven-yellow-table
File name:Invoice_1509_October-25.html
Download: download sample
Signature IcedID
Create hunting rule
File size:548'150 bytes
First seen:2022-10-25 19:51:14 UTC
Last seen:Never
File type: html
MIME type:text/html
ssdeep 12288:8IWZsBo1fq0d/ZEJn1e5u9E7eyD+E90tddyYCvOu:8IWrfb41IuKiS+E9OdLBu
TLSH T184C412251AC42FA9DFAC560D40BF260E97A04B8A6516E5CEFB337E47AFFB540021B14D
Reporter k3dg3___
Tags:1879083763 html IcedID

Intelligence

File Origin
# of uploads :
1
# of downloads :
313
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
TwinWave.EvilHTML.QakbotTheDuck.20221017.UNOFFICIAL
Create hunting rule

Result
Threat name:
HtmlDropper, IcedID
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1097864
Signature
C2 URLs / IPs found in malware configuration
Contains functionality to detect hardware virtualization (CPUID execution measurement)
Drops PE files with a suspicious file extension
HTML document with suspicious name
HTML document with suspicious title
Malicious sample detected (through community Yara rule)
System process connects to network (likely due to code injection or exploit)
Tries to detect virtualization through RDTSC time measurements
Uses 7zip to decompress a password protected archive
Yara detected Html Dropper
Yara detected IcedID
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 730515 Sample: Invoice_1509_October-25.html Startdate: 25/10/2022 Architecture: WINDOWS Score: 100 45 seedhlumening.com 2->45 59 Malicious sample detected (through community Yara rule) 2->59 61 Yara detected Html Dropper 2->61 63 Yara detected IcedID 2->63 65 3 other signatures 2->65 10 chrome.exe 18 8 2->10         started        13 chrome.exe 2->13         started        signatures3 process4 dnsIp5 55 192.168.2.1 unknown unknown 10->55 57 239.255.255.250 unknown Reserved 10->57 15 unarchiver.exe 5 10->15         started        18 chrome.exe 10->18         started        process6 dnsIp7 75 Uses 7zip to decompress a password protected archive 15->75 21 cmd.exe 2 15->21         started        24 cmd.exe 1 15->24         started        27 7za.exe 2 15->27         started        47 seedhlumening.com 18->47 49 clients.l.google.com 142.250.184.206, 443, 49700 GOOGLEUS United States 18->49 51 4 other IPs or domains 18->51 signatures8 process9 file10 43 C:\Users\user\AppData\...\ovalRingleaders.com, PE32 21->43 dropped 29 ovalRingleaders.com 21->29         started        31 conhost.exe 1 21->31         started        67 Drops PE files with a suspicious file extension 24->67 33 powershell.exe 36 24->33         started        35 conhost.exe 24->35         started        37 conhost.exe 27->37         started        signatures11 process12 process13 39 rundll32.exe 29->39         started        dnsIp14 53 seedhlumening.com 167.99.220.73, 49728, 49729, 49730 DIGITALOCEAN-ASNUS United States 39->53 69 System process connects to network (likely due to code injection or exploit) 39->69 71 Contains functionality to detect hardware virtualization (CPUID execution measurement) 39->71 73 Tries to detect virtualization through RDTSC time measurements 39->73 signatures15
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/3f8e1e14a9ae69a06814eae4e7bfa221f814b6d2298e66b4850f5c416196af17/
Threat name:
Text.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2022-10-25 15:34:22 UTC
File Type:
Text (HTML)
Extracted files:
3
AV detection:
3 of 41 (7.32%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=h6hb4ffjvzu2a2au5lsopp5ceh4bjnwsfghgnnefb5oecymwv4lq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
IcedID
Score:
0.90
Link:
https://yomi.yoroi.company/submissions/3f8e1e14a9ae69a06814eae4e7bfa221f814b6d2298e66b4850f5c416196af17

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:BitcoinAddress
Create hunting rule
Author:Didier Stevens (@DidierStevens)
Description:Contains a valid Bitcoin address

File information

The table below shows additional information about this malware sample such as delivery method and external references.

IcedID

Executable exe 62787ccf339fe3e7689e8e4ab651e0bb4c29742d6dfeb4a12652f97f8e723c52

IcedID

html 3f8e1e14a9ae69a06814eae4e7bfa221f814b6d2298e66b4850f5c416196af17

(this sample)

  
Link
https://tria.ge/221025-yg969adgak/behavioral1
  
Dropped by
SHA256 62787ccf339fe3e7689e8e4ab651e0bb4c29742d6dfeb4a12652f97f8e723c52
  
Delivery method
Distributed via e-mail attachment
  
Dropped by
MD5 4a18e8b492d063ffdf9540aee70bc367

Comments