MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4b4ef74c5e07471f8b5d379723d468e378798a49ba5446a71be1b135cae4bf07. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


IcedID


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4b4ef74c5e07471f8b5d379723d468e378798a49ba5446a71be1b135cae4bf07
SHA3-384 hash: 96ad6773452b6621d2f43fc876c5449d89b2f04f2574cd1991aee7785c6410b48a1e482ec49702257f8b5675105cb8e4
SHA1 hash: 45ccba9aac6191bf4819dab71016a7d5b60113f4
MD5 hash: eecc74d89b869c1580b7f4b624ddff92
humanhash: salami-artist-sodium-uranus
File name:2.dll
Download: download sample
Signature IcedID
Create hunting rule
File size:645'148 bytes
First seen:2022-02-04 14:28:01 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 01f87ec9e1e36146b71b7ffce4fd5fa9 (20 x IcedID)
ssdeep 12288:FTsor70Aeojgc4+o07OCi6HY7FpW0zm0pF:FTXjeojgc4+lDZY5pF
TLSH T120D4AF39636507B5E0739434C9734943C6F17CB117B095EBA3A1325A0E3BFE5A63AB22
Reporter JAMESWT_WT
Tags:exe IcedID

Intelligence

File Origin
# of uploads :
1
# of downloads :
293
Origin country :
n/a
Vendor Threat Intelligence
Detection:
IcedIDLoader
Create hunting rule
Link:
https://www.capesandbox.com/analysis/233040/
Detection(s):
SecuriteInfo.com.VHO.Trojan.Win32.Sdum.gen.11852.3673.UNOFFICIAL
Create hunting rule

Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/5991/overview
Behaviour
SystemUptime
MeasuringTime
EvasionQueryPerformanceCounter
EvasionGetTickCount
CheckCmdLine
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/727cdffb-d114-4b3b-ad86-f89836ee8c93
Result
Threat name:
Unknown
Detection:
suspicious
Classification:
n/a
Score:
28 / 100
Link:
https://www.joesandbox.com/analysis/933988
Signature
Sigma detected: Suspicious Call by Ordinal
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 566466 Sample: 2.dll Startdate: 04/02/2022 Architecture: WINDOWS Score: 28 19 Sigma detected: Suspicious Call by Ordinal 2->19 7 loaddll64.exe 1 2->7         started        process3 process4 9 cmd.exe 1 7->9         started        11 rundll32.exe 7->11         started        13 rundll32.exe 7->13         started        15 2 other processes 7->15 process5 17 rundll32.exe 9->17         started       
Gathering data
Threat name:
Win64.Trojan.IcedID
Create hunting rule
Status:
Malicious
First seen:
2022-02-04 14:28:13 UTC
File Type:
PE+ (Dll)
Extracted files:
7
AV detection:
17 of 28 (60.71%)
Threat level:
  5/5
Result
Malware family:
icedid
Create hunting rule
Score:
  10/10
Tags:
family:icedid campaign:1732687004 banker persistence suricata trojan
Link:
https://tria.ge/reports/220204-rs1cvsbbgl/
Behaviour
Modifies data under HKEY_USERS
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Drops file in Windows directory
Sets service image path in registry
IcedID, BokBot
suricata: ET MALWARE Win32/IcedID Request Cookie
Malware Config
C2 Extraction:
keepfootbal.com
Unpacked files
SH256 hash:
4b4ef74c5e07471f8b5d379723d468e378798a49ba5446a71be1b135cae4bf07
MD5 hash:
eecc74d89b869c1580b7f4b624ddff92
SHA1 hash:
45ccba9aac6191bf4819dab71016a7d5b60113f4
Link:
https://www.unpac.me/results/6f363499-ae06-4bb9-8cc1-47eaf82cc2bf/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/4b4ef74c5e07471f8b5d379723d468e378798a49ba5446a71be1b135cae4bf07

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/233040/

Comments