MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 40bbcb27f601b5500428fa56d0c24617171706ed69c9e1ee205150a1e22f5321. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
IcedID
Vendor detections: 5
| SHA256 hash: | 40bbcb27f601b5500428fa56d0c24617171706ed69c9e1ee205150a1e22f5321 |
|---|---|
| SHA3-384 hash: | a29f7aac862cbd2dd4d4a0f4e87869e36158550273ff92492438afa094591a591810ac29dfe6355504e316e90b186762 |
| SHA1 hash: | 47d9944f06ced9d376de8fdaa1417cd7211c74ba |
| MD5 hash: | b9bff9e98fd687086b5e1dad7c57ea32 |
| humanhash: | angel-seventeen-fillet-enemy |
| File name: | Setup_Win_02-02-2023_18-14-35.zip |
| Download: | download sample |
| Signature | IcedID |
| File size: | 844'871 bytes |
| First seen: | 2023-02-02 18:27:51 UTC |
| Last seen: | Never |
| File type: | zip |
| MIME type: | application/zip |
| ssdeep | 3072:WpxR7Q7+O709OQv6pMz/BPnP6tINspRmIo:WpxC097z/BPnCtispRmh |
| TLSH | T12205023BE5453472E746C27C28AC1B9D11A21D0162EF1AEE9936984F3CE1E377670C13 |
| TrID | 80.0% (.ZIP) ZIP compressed archive (4000/1) 20.0% (.PG/BIN) PrintFox/Pagefox bitmap (640x800) (1000/1) |
| Reporter |  abuse_ch |
| Tags: | 1398120717 IcedID malvertising thunderbird zip |
abuse_ch
IcedID distributed through malvertising campaign on Google Search:https://thunnderbilp.space/
-> https://us-thunderbird-soft.top/
--> https://firebasestorage.googleapis.com/v0/b/single-quanta-370810.appspot.com/o/4x3E3O0fVD%2FSetup_Win_02-02-2023_18-14-35.zip?alt=media&token=3088b9a7-702a-42b1-97e9-1a7b5638e3ce
IcedID botnet C2:
http://loliapitudet.com/
Intelligence
File Origin
# of uploads :
1
# of downloads :
162
Origin country :
CHFile Archive Information
This file archive contains 1 file(s), sorted by their relevance:
| File name: | Setup_Win_02-02-2023_18-14-32.exe |
|---|---|
| File size: | 737'476'608 bytes |
| SHA256 hash: | 16aec3e3b7581425211c79ea59edee00e791315a8eab47a244c371d895617fac |
| MD5 hash: | b617767ca55193deb6b154bd167353c8 |
| MIME type: | application/x-dosexec |
| Signature | IcedID |
Vendor Threat Intelligence
Gathering data
Threat name:
Archive.Trojan.Hulk
Status:
Malicious
First seen:
2023-02-02 19:18:38 UTC
AV detection:
5 of 38 (13.16%)
Threat level:
5/5
Detection(s):
Suspicious file
Result
Malware family:
icedid
Score:
10/10
Tags:
family:icedid campaign:1398120717 banker loader trojan
Behaviour
Suspicious behavior: EnumeratesProcesses
IcedID, BokBot
Malware Config
C2 Extraction:
loliapitudet.com
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Web download
IcedID
zip 40bbcb27f601b5500428fa56d0c24617171706ed69c9e1ee205150a1e22f5321
(this sample)
Delivery method
Distributed via web download
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.