MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 42cea91c813a490a0b590932c940d796fadfc97765291506813b0ae6f2a42fed. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


IcedID


Vendor detections: 13


Intelligence 13 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 42cea91c813a490a0b590932c940d796fadfc97765291506813b0ae6f2a42fed
SHA3-384 hash: 7a6dbf9de0fc7e1a755e86f2a009eeac193e3489563a927ff6483eea9ca165fa0fce785110370788226833108475e958
SHA1 hash: a06d64929c4df25fa798bb5aeba6c45dddb68c4f
MD5 hash: d85f31f8c9a77b723f0b33c64aee0e25
humanhash: september-october-shade-seven
File name:0x0002000000022618-2.dll
Download: download sample
Signature IcedID
Create hunting rule
File size:335'872 bytes
First seen:2023-10-12 00:42:25 UTC
Last seen:2023-10-12 01:42:01 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash e7125b885fcd1eea77d2881eaaa53c4d (6 x IcedID)
ssdeep 6144:3N/F41OWGRkFtwxW6spj/JbUaeboh6EReEUHFmUwUBS8OgJU9P:35FCOWGRayW6sAowXFmUwUE1gI
Threatray 42 similar samples on MalwareBazaar
TLSH T1AE64AE0976D80CB9EDB39238C9576945E972BC160774D66F03A0831ADF2F790A92FF21
TrID 48.7% (.EXE) Win64 Executable (generic) (10523/12/4)
23.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
9.3% (.EXE) OS/2 Executable (generic) (2029/13)
9.2% (.EXE) Generic Win/DOS Executable (2002/3)
9.2% (.EXE) DOS Executable Generic (2000/1)
Reporter JAMESWT_WT
Tags:exe gestionhqse-com IcedID

Intelligence

File Origin
# of uploads :
2
# of downloads :
409
Origin country :
IT IT
Vendor Threat Intelligence
Malware family:
icedid
Create hunting rule
ID:
1
File name:
Offer[2023.10.11_08-07]_3.vbs
Verdict:
Malicious activity
Analysis date:
2023-10-11 23:44:26 UTC
Tags:
icedid bokbot loader
Link:
https://app.any.run/tasks/4e386707-83ab-4027-966a-14031a9c6031

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/453597/
Detection(s):
SecuriteInfo.com.Win64.TrojanX-gen.30672.2208.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
DNS request
Sending a custom TCP request
Sending an HTTP GET request
Creating a file in the %AppData% subdirectories
Сreating synchronization primitives
Running batch commands
Creating a process with a hidden window
Launching a process
Enabling autorun by creating a file
Gathering data
Verdict:
No Threat
Threat level:
  10/10
Confidence:
100%
Tags:
control greyware lolbin masquerade packed
Link:
https://www.filescan.io/uploads/65274118853e4f06480a2d43/reports/9d95e116-7305-4a4c-bb4b-5242de28511f/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/42cea91c813a490a0b590932c940d796fadfc97765291506813b0ae6f2a42fed
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/998b7ffc-83ff-4a51-89ab-3b59ec304055
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/42cea91c813a490a0b590932c940d796fadfc97765291506813b0ae6f2a42fed/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Malicious
First seen:
2023-10-12 00:43:06 UTC
File Type:
PE+ (Dll)
Extracted files:
9
AV detection:
7 of 38 (18.42%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ilhkshebhjequc2zbezmsqgxs35n7slxmuurkbubhmfon4vef7wq._file
Verdict:
malicious
Similar samples:
09f7e968376ea4a0ec8a8edc1281ad3d884f34b251c225e0cae5fa10cb7b2707
IcedID
0a61d734db49fdf92f018532b2d5e512e90ae0b1657c277634aa06e7b71833c4
IcedID
51215d7d543fa28d5327e31002069f37a17cbed4b539bbf437d3a56cf906d3db
IcedID
5bab2bc0843f9d5124b39f80e12ad6d1f02416b0340d7cfec8cf7b14cd4385bf
IcedID
69e3c157249070aec7d5e003cd6b3dd05f87b555e4997e4c11cc5ff07462e3db
IcedID
8a271be660b40e3b923bc8ba9479aa54d38cb232dd27e1217ad26e547e3a73bc
IcedID
8c5c7a8cdda35d77ae8e90a14e0732b6b48e4efb453434ac4d5e7df0e625b06a
IcedID
a12045a6177dd32af8b39dea93fa92962ff1716381d0d137dede1fc75ecd2c0c
IcedID
c3cfabfe54884ee0bf1d2f990571c5accee775e1d76f28c1b891893ad2e2382e
IcedID
f3100825207882bc6014c3f5b1a168e5e0328e41869b2f360a3733da2e096e41
IcedID
+ 32 additional samples on MalwareBazaar
Result
Malware family:
icedid
Create hunting rule
Score:
  10/10
Tags:
family:icedid campaign:361893872 banker trojan
Link:
https://tria.ge/reports/231012-a2xjwsdg7w/
Behaviour
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
Loads dropped DLL
Blocklisted process makes network request
IcedID, BokBot
Unpacked files
SH256 hash:
798ae198bdcf45cd7138bf44d27cb5d9b14e47e4d9a9e6541be9fafd4b92d214
MD5 hash:
7e868fdc01742362e371ca903d64606f
SHA1 hash:
f42531a11fd04835f957346ba164967851291d1e
Detections:
IcedIDLoaderFork
Create hunting rule
Link:
https://www.unpac.me/results/d5ec4217-c3ca-4b98-b194-471bf8a779e5/
Parent samples :
a12045a6177dd32af8b39dea93fa92962ff1716381d0d137dede1fc75ecd2c0c
5e3bb62b44636f502e387d4c00bd5a7bc1d040332028238ccd812f73e6d859ca
f324bb47090d388fca1015260f66f67b708e8451292cd5679791792c90d5b711
42cea91c813a490a0b590932c940d796fadfc97765291506813b0ae6f2a42fed
ead7621affb3dcfa1137359639f3df8060fca2e5aafd65322a7d67745726b88c
03b25f3a6a6612eca075b0253d7e8ae6ee556bb5375ab7f38b408da15c1b6af9
8901e289c92449e47212b5e6e948ee1d12e9d809af9026ea39834f595bc9f238
SH256 hash:
42cea91c813a490a0b590932c940d796fadfc97765291506813b0ae6f2a42fed
MD5 hash:
d85f31f8c9a77b723f0b33c64aee0e25
SHA1 hash:
a06d64929c4df25fa798bb5aeba6c45dddb68c4f
Link:
https://www.unpac.me/results/d5ec4217-c3ca-4b98-b194-471bf8a779e5/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/42cea91c813a490a0b590932c940d796fadfc97765291506813b0ae6f2a42fed

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:TrojanSpy_EMOTET_W4
Create hunting rule
Author:Ian Kenefick (Trend Micro)
Description:Emotet x64 Loader

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/453597/

Comments