MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 412d5f8f15db39029d623549db704d8acca0136b050fca4baaaa1ee620dbb441. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
IcedID
Vendor detections: 7
| SHA256 hash: | 412d5f8f15db39029d623549db704d8acca0136b050fca4baaaa1ee620dbb441 |
|---|---|
| SHA3-384 hash: | 5071f0f1a6033f9699765e99666b28f749b371b1cd4339f96cd2d57d846370a07c760f9a0e579d8d432daebc2b16094b |
| SHA1 hash: | 85ac4487a686f6c1d368ac3c6675424ceb0b40b5 |
| MD5 hash: | 6c5ff25e8c46c6fcd9b1845a62c8c7d7 |
| humanhash: | floor-violet-november-winner |
| File name: | kZgra.pdf |
| Download: | download sample |
| Signature | IcedID |
| File size: | 225'794 bytes |
| First seen: | 2020-10-09 21:30:21 UTC |
| Last seen: | Never |
| File type: |  dll |
| MIME type: | application/x-dosexec |
| imphash | b4621f50f3aeb6804e6ffb09fc8d51f2 (19 x IcedID) |
| ssdeep | 3072:jUC76ZySY0b3MaIFh234cBDV0rBV+mPKFj5XbsDvHrYNGscWrAIykbQ8gAZAOw:Wd3mQvSqmPKFBbsTHr8Gs2IykbJ6V |
| Threatray | 399 similar samples on MalwareBazaar |
| TLSH | A6245D00AA51D039F4F752F885BB9368E62C7EA05B2451CF62C61EEE8774BF09C31697 |
| Reporter |  malware_traffic |
| Tags: | dll IcedID Shathak TA551 |
Intelligence
File Origin
# of uploads :
1
# of downloads :
177
Origin country :
n/a
Vendor Threat Intelligence
Detection:
IcedID
Result
Verdict:
Malware
Maliciousness:
Behaviour
Sending a UDP request
DNS request
Sending a custom TCP request
Result
Threat name:
Unknown
Detection:
malicious
Classification:
n/a
Score:
52 / 100
Signature
Initial sample is a PE file and has a suspicious name
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Threat name:
Win32.Trojan.IcedID
Status:
Malicious
First seen:
2020-10-09 21:32:06 UTC
AV detection:
24 of 29 (82.76%)
Threat level:
5/5
Verdict:
malicious
Label(s):
icedid
Similar samples:
+ 389 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
8/10
Tags:
n/a
Behaviour
Modifies system certificate store
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Blacklisted process makes network request
Unpacked files
SH256 hash:
412d5f8f15db39029d623549db704d8acca0136b050fca4baaaa1ee620dbb441
MD5 hash:
6c5ff25e8c46c6fcd9b1845a62c8c7d7
SHA1 hash:
85ac4487a686f6c1d368ac3c6675424ceb0b40b5
SH256 hash:
abed292b4e0fdab18a976de9385cd64e64b09d7c646f65b25bc7bec1a9556d98
MD5 hash:
9411e515b70d1f3de3c068998a6749d6
SHA1 hash:
05191aaf8be407030e90c0cf6b4a0f4cf5da2f9b
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Trojan
Score:
1.00
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.