MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4974d10d803aca30531d560b26f653c8e210b08d02cc0c94412d5cb7c218c36e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


IcedID


Vendor detections: 7


Intelligence 7 IOCs 1 YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4974d10d803aca30531d560b26f653c8e210b08d02cc0c94412d5cb7c218c36e
SHA3-384 hash: a9de479a711156c2ad6998aad209109793beb21a0fa023af1f5147fd5d6e7ba07f6f55e6917122a915370bd4e6370031
SHA1 hash: 1cd9f850ef22d1382435762a7accc205af255c40
MD5 hash: bba19b10a84ba60c26175ef41dc2760a
humanhash: october-hamper-network-virginia
File name:bba19b10a84ba60c26175ef41dc2760a.dll
Download: download sample
Signature IcedID
Create hunting rule
File size:44'390 bytes
First seen:2021-03-30 16:06:14 UTC
Last seen:2021-03-30 16:44:54 UTC
File type:Executable exe
MIME type:application/x-dosexec
ssdeep 768:RHppffnqCuZgKEq2OqmBhw9+eyA/Dj74zZ/mgxH7Wgagg1nXFJBMq/umJUZp:NDqvHEbsBneyAbniZPWznfBL/nM
Threatray 231 similar samples on MalwareBazaar
TLSH 35135DCA05700B22D5365672C5B31B28C27BFB40B7D368FBD19C7698C5C2180D772DAA
Reporter abuse_ch
Tags:dll IcedID


Avatar
abuse_ch
IcedID C2:
usaaforced.fun

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
usaaforced.fun https://threatfox.abuse.ch/ioc/6146/

Intelligence

File Origin
# of uploads :
2
# of downloads :
105
Origin country :
n/a
Vendor Threat Intelligence
Detection:
BazaLoader
Create hunting rule
Link:
https://www.capesandbox.com/analysis/128302/
Detection(s):
SecuriteInfo.com.Variant.Ulise.194575.13028.17214.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Sending a UDP request
Deleting a recently created file
Creating a file in the Windows subdirectories
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4974d10d803aca30531d560b26f653c8e210b08d02cc0c94412d5cb7c218c36e/
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=jf2ncdmahlfdauy5kyfsn5stzdrbbmenalgazfcbfvolpqqyynxa._file
Verdict:
malicious
Label(s):
icedid
Create hunting rule
Similar samples:
286707e2bb83a6c40652e6621556895dec756bc7b8ddb16518e5942d6ec3665f
IcedID
31405497b5a9ac591cc1098d3316d74717e18fec00a4f584495bd38c0b6aaf14
IcedID
45c2bb18079e07f9c02b75b5ba108580005ccccfc7914457704593f09104da33
IcedID
bef7d4ef86cd6e13c9af1c199000378152520079ea6a66cef0a4d0a2a9bb9ac1
IcedID
c34abd5384784f29b34e8fc5050fa25a12e869af96ad3535fce355e7a49634e9
IcedID
c729627eb14cabc48a505e46136db35d75ab1f4804bfc419587dd1a4536216b8
IcedID
d800fd83e442a5a98c9baed2617242cb8abdcd13534c80eebed8b515c6e22109
IcedID
df8780cff5e2c8bf3105c53a0ea7375308b6131646636cda83bc29fbf5da859f
IcedID
e8a173d233228c5d464ee9028c58bdbab50367db00e99b4817be9d0d7f677850
IcedID
ef40d547e887d0fb80d6f7902dc477de2cc7feb175cd16ebde2ecafea75acb30
IcedID
+ 221 additional samples on MalwareBazaar
Result
Malware family:
icedid
Create hunting rule
Score:
  10/10
Tags:
family:icedid banker loader trojan
Link:
https://tria.ge/reports/210330-nckkm5kvge/
Behaviour
Suspicious behavior: EnumeratesProcesses
IcedID First Stage Loader
IcedID, BokBot
Malware Config
C2 Extraction:
usaaforced.fun
Unpacked files
SH256 hash:
4974d10d803aca30531d560b26f653c8e210b08d02cc0c94412d5cb7c218c36e
MD5 hash:
bba19b10a84ba60c26175ef41dc2760a
SHA1 hash:
1cd9f850ef22d1382435762a7accc205af255c40
Link:
https://www.unpac.me/results/9239c5d9-e6a7-44a4-852a-b389db5d28b7/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.76
Link:
https://yomi.yoroi.company/submissions/4974d10d803aca30531d560b26f653c8e210b08d02cc0c94412d5cb7c218c36e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:crime_win32_icedid_stage1
Create hunting rule
Author:Rony (@r0ny_123)
Description:Detects IcedID Photoloader
Reference:https://sysopfb.github.io/malware,/icedid/2020/04/28/IcedIDs-updated-photoloader.html
Rule name:IcedID
Create hunting rule
Author:@bartblaze
Description:Identifies IcedID (stage 1 and 2, loaders).
Rule name:IcedIDStage1
Create hunting rule
Author:kevoreilly, threathive, enzo
Description:IcedID Payload
Rule name:MALWARE_Win_IceID
Create hunting rule
Author:ditekSHen
Description:Detects IceID / Bokbot variants

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

IcedID

Executable exe 4974d10d803aca30531d560b26f653c8e210b08d02cc0c94412d5cb7c218c36e

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1098495/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/128302/

Comments