MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 54d064799115f302a66220b3d0920c1158608a5ba76277666c4ac532b53e855f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


IcedID


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 54d064799115f302a66220b3d0920c1158608a5ba76277666c4ac532b53e855f
SHA3-384 hash: c26b23d5100a1c2503c80f33b04fb921e6bb9a67a481ae63d0454ff2996744e34979badd1d5f6a6d630499d661e5ab7c
SHA1 hash: 857d6184e51a71b0c46dda1d4534f482d66727ed
MD5 hash: aaafffc6419c22d36e23fa0eabd1c27a
humanhash: vermont-arizona-eleven-magnesium
File name:2023-04-12-gzip-binary-from-shoterqana.com.bin
Download: download sample
Signature IcedID
Create hunting rule
File size:647'389 bytes
First seen:2023-04-12 05:38:16 UTC
Last seen:Never
File type: gz
MIME type:application/gzip
ssdeep 12288:SfVVhWtvmwKeKZbFS2BW3Gn/gG69XEI8WLVbgsv0nH2vdLf3VKb8K03ejlw8Tn:StVhWVmJbn6UF61rVbJ0Hwl88tx8Tn
TLSH T1E5D42336F0D5C0636C955AB8C6675BF8E21074ECDB1EC71860ACE4A254B90B735AF0EB
Reporter malware_traffic
Tags:BokBot gz gzip IcedID


Avatar
malware_traffic
Gzip binary from shoterqana[.]com retrieved by installer EXE for IcedID on 2023-04-11

Intelligence

File Origin
# of uploads :
1
# of downloads :
323
Origin country :
US US
Vendor Threat Intelligence
Gathering data
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/54d064799115f302a66220b3d0920c1158608a5ba76277666c4ac532b53e855f
Result
Verdict:
UNKNOWN
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/54d064799115f302a66220b3d0920c1158608a5ba76277666c4ac532b53e855f/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ktigi6mrcxzqfjtcecz5beqmcfmgbcs3u5rhoztmjlctfnj6qvpq._file
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/230412-gm2cvsbh5w/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/54d064799115f302a66220b3d0920c1158608a5ba76277666c4ac532b53e855f

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments