MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 539c339c67f87349e48c9c48faf7d38673f53f8fbf8ee5ba8f67a2f670092ba3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


IcedID


Vendor detections: 6


Intelligence 6 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 539c339c67f87349e48c9c48faf7d38673f53f8fbf8ee5ba8f67a2f670092ba3
SHA3-384 hash: 550133abf3c7cd6ad49aa9af35b6eed59869ea301d12bd57ca4e64c5dbf1a15af78349f8b68535d9a0b2b58267e2c2bf
SHA1 hash: 27be2388e37d7de2ad7e1a670923d1b39d79ffce
MD5 hash: aa7dfc96261ea2aa018229d84f673d3f
humanhash: sierra-two-hamper-fourteen
File name:Ub.pdf
Download: download sample
Signature IcedID
Create hunting rule
File size:363'520 bytes
First seen:2020-07-23 17:45:49 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash e12de558fc5f90844c4257a198ff766b (2 x IcedID)
ssdeep 6144:KAyWSI2vptj6HkHJeuF4+um+8loqDGGmLv:VuvptGHkHAua+Z+IkG2v
Threatray 749 similar samples on MalwareBazaar
TLSH 13746D01FA90D039F4FB01B95AB681A9A9387D601B7CC4CBA7C1259F1B346E2ED31B57
Reporter malware_traffic
Tags:dll IcedID

Intelligence

File Origin
# of uploads :
1
# of downloads :
101
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/31904/
Detection(s):
PUA.Win.Downloader.Aiis-6803892-0
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Sending a custom TCP request
Result
Threat name:
Unknown
Detection:
malicious
Classification:
n/a
Score:
52 / 100
Link:
https://www.joesandbox.com/analysis/396632
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 250558 Sample: Ub.pdf Startdate: 24/07/2020 Architecture: WINDOWS Score: 52 21 Multi AV Scanner detection for submitted file 2->21 23 Initial sample is a PE file and has a suspicious name 2->23 7 AcroRd32.exe 35 2->7         started        process3 process4 9 RdrCEF.exe 5 7->9         started        11 AcroRd32.exe 6 7->11         started        process5 13 RdrCEF.exe 9->13         started        15 RdrCEF.exe 9->15         started        17 RdrCEF.exe 9->17         started        19 2 other processes 9->19
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/539c339c67f87349e48c9c48faf7d38673f53f8fbf8ee5ba8f67a2f670092ba3/
Threat name:
Win32.Trojan.IcedID
Create hunting rule
Status:
Malicious
First seen:
2020-07-23 17:47:05 UTC
AV detection:
21 of 29 (72.41%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=koodhhdh7bzutzemtrepv56tqzz7kp4px6holoupm6rpm4ajforq._file
Verdict:
malicious
Label(s):
icedid
Create hunting rule
gozi
Create hunting rule
Similar samples:
22a028d138a87ac7c6f7e5eb054032eecddae1a76361c9443095e65fb6f51850
IcedID
253af6bb3c7415b92c05c70a9893ad9cb736d8139c0dfeddce3719a731a7fceb
IcedID
6196a0966d3fbe5726736f0fd7661a0a928fdce345cb377e79cea039594a79f0
IcedID
763045778cf8977b3da1f081ce871cf57570cfafa98d9d4c0334e554a0d77ac3
IcedID
7d97f43bdac6a0420b701f622c164af9f6aed64cb5f3cdbdc3bc44088b0ac2d9
IcedID
8f0325a3648ae0bea65ba84f6157726c6b81b19daa9f6266863e4778823f95a0
IcedID
b97cc0d33b7a728206da8f7b3b46bdf383cab4999db18fb11bda86c4a16c6fa9
IcedID
c437f3873a582bcb2299a97ee1778b2cc2962ac4b5a827024997415bb080e89e
IcedID
d5ecd475bcc040e1b4b1e0d4927a462aa7e8fab048470d855764855351860d49
IcedID
e9e643722767e6dc2458c66e61f6a1ea1aba915bdc52058b06eb89a29aa8fec8
IcedID
+ 739 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
n/a
Link:
https://tria.ge/reports/200723-d61y21jwks/
Behaviour
Suspicious use of WriteProcessMemory
Suspicious behavior: EnumeratesProcesses
Modifies system certificate store
Suspicious use of WriteProcessMemory
Suspicious behavior: EnumeratesProcesses
Blacklisted process makes network request
Blacklisted process makes network request
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Trojan
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/539c339c67f87349e48c9c48faf7d38673f53f8fbf8ee5ba8f67a2f670092ba3

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:win_unidentified_023_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/31904/

Comments