MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3fca3f2d46add510a32d81b2ba8b4a5f30fc8ec25eca34175405bf5580a1bec3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

IcedID

Vendor detections: 7

Intelligence 7 IOCs YARA 1 File information Comments

SHA256 hash:	3fca3f2d46add510a32d81b2ba8b4a5f30fc8ec25eca34175405bf5580a1bec3
SHA3-384 hash:	1faf86e49ecf4880d6acea5273191725dba723636b49b23702a6d8bc60effd48b1e802baf79e5b1732b37c0b1e6e0605
SHA1 hash:	459ab23e461a04ae79317a97bb715ac9eee88883
MD5 hash:	5b9f8e3e5c3e4d00312541558358f1c0
humanhash:	sixteen-network-earth-uniform
File name:	dll.dll
Download:	download sample
Signature	IcedID Create hunting rule
File size:	85'544 bytes
First seen:	2021-03-18 14:39:34 UTC
Last seen:	2021-03-18 16:32:49 UTC
File type:	exe
MIME type:	application/x-dosexec
ssdeep	1536:5YbUwiUzdCOC1q9KgaCLVoAS5cnrAU+d1UY1gRbX86hF/K8A:SbUwiUzdCOC1q9KgaCLVR43AbX86H
Threatray	25 similar samples on MalwareBazaar
TLSH	7383F7DF40D00E62C4B22631CC91437181736E45A79EA4FBF5C49FA0CA657DCEB19AAE
Reporter	JAMESWT_WT
Tags:	IcedID SFB Regnskabsservice ApS signed

Code Signing Certificate

Organisation:	SFB Regnskabsservice ApS
Issuer:	Sectigo RSA Code Signing CA
Algorithm:	sha256WithRSAEncryption
Valid from:	2021-03-04T00:00:00Z
Valid to:	2022-03-04T23:59:59Z
Serial number:	3fd3661533eef209153c9afec3ba4d8a
MalwareBazaar Blocklist:	This certificate is on the MalwareBazaar code signing certificate blocklist (CSCB)
Thumbprint Algorithm:	SHA256
Thumbprint:	c2721fee09232c2e16ec8c3c6e1645b2af509faab8144d9c53ac4a8374e6d6e0
Source:	This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin

# of uploads :

# of downloads :

202

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

dll.dll

Verdict:

No threats detected

Analysis date:

2021-03-18 14:42:08 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/1947034f-1ae0-4fca-a1e9-4434897cc276

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/125478/

Detection(s):

SecuriteInfo.com.Artemis5B9F8E3E5C3E.7241.13153.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Launching a process

Sending a custom TCP request

DNS request

Sending a UDP request

Sending an HTTP GET request

Result

Verdict:

SUSPICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/3fca3f2d46add510a32d81b2ba8b4a5f30fc8ec25eca34175405bf5580a1bec3/

Threat name:

Win64.Trojan.Ligooc

Status:

Malicious

First seen:

2021-03-18 14:40:14 UTC

File Type:

PE+ (Dll)

AV detection:

12 of 28 (42.86%)

Threat level:

5/5

Verdict:

malicious

Label(s):

icedid

Result

Malware family:

icedid

Score:

10/10

Tags:

family:icedid banker trojan

Link:

https://tria.ge/reports/210318-mt2gd84hbs/

Behaviour

Suspicious behavior: EnumeratesProcesses

IcedID, BokBot

Malware Config

C2 Extraction:

apoxiolazio55.space

Unpacked files

SH256 hash:

3fca3f2d46add510a32d81b2ba8b4a5f30fc8ec25eca34175405bf5580a1bec3

MD5 hash:

5b9f8e3e5c3e4d00312541558358f1c0

SHA1 hash:

459ab23e461a04ae79317a97bb715ac9eee88883

Link:

https://www.unpac.me/results/2868115d-f442-4895-995f-ce55976e86e9/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.10

Link:

https://yomi.yoroi.company/submissions/3fca3f2d46add510a32d81b2ba8b4a5f30fc8ec25eca34175405bf5580a1bec3

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	crime_win32_icedid_stage1 Create hunting rule
Author:	Rony (@r0ny_123)
Description:	Detects IcedID Photoloader
Reference:	https://sysopfb.github.io/malware,/icedid/2020/04/28/IcedIDs-updated-photoloader.html