MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 56a48447a0e8f841f188f8f3ab6e88d1669937834249be56b078378e89e03fc2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

IcedID

Vendor detections: 7

Intelligence 7 IOCs 1 YARA 1 File information Comments

SHA256 hash:	56a48447a0e8f841f188f8f3ab6e88d1669937834249be56b078378e89e03fc2
SHA3-384 hash:	d8bc3434d6ccd444dbd25ea980cf79345531aa1b6ebe0b3d42dc9419a48a8a5dbc3b5df733be293122f6c1ca3c442684
SHA1 hash:	34ce17ec097faa4c0565eab32d9c0a251d02f1c9
MD5 hash:	424b5a23c3cadc04d7e8b99438721be1
humanhash:	saturn-video-oscar-uncle
File name:	424b5a23c3cadc04d7e8b99438721be1.dll
Download:	download sample
Signature	IcedID Create hunting rule
File size:	44'565 bytes
First seen:	2021-03-30 16:11:53 UTC
Last seen:	2021-03-30 16:44:55 UTC
File type:	exe
MIME type:	application/x-dosexec
ssdeep	768:RHppffnqCuZgKEq2OqmBhw9+eyA/Dj74zZ/mgxH7Wgagg1nXFJBMq/umJUZp:NDqvHEbsBneyAbniZPWznfBL/nM
Threatray	243 similar samples on MalwareBazaar
TLSH	4F135DCA05700B22D5365672C5B31B28C27BFB40B7D368FBD19C7698C5C2180D772DAA
Reporter	abuse_ch
Tags:	dll IcedID

abuse_ch

IcedID C2:
usaaforced.fun

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOC	ThreatFox Reference
usaaforced.fun	https://threatfox.abuse.ch/ioc/6146/

Intelligence

File Origin

# of uploads :

# of downloads :

114

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

424b5a23c3cadc04d7e8b99438721be1.dll

Verdict:

No threats detected

Analysis date:

2021-03-31 02:34:29 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/b1339d07-603c-46d5-9754-b4c90eb5d80e

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

BazaLoader

Link:

https://www.capesandbox.com/analysis/128351/

Detection(s):

SecuriteInfo.com.Variant.Ulise.194575.2282.27672.UNOFFICIAL

Result

Verdict:

Clean

Maliciousness:

Behaviour

Deleting a recently created file

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/56a48447a0e8f841f188f8f3ab6e88d1669937834249be56b078378e89e03fc2/

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=k2siir5a5d4ed4mi7dz2w3ui2ftjsn4dije34vvqpa3y5cpah7ba._file

Verdict:

malicious

Label(s):

icedid

Result

Malware family:

icedid

Score:

10/10

Tags:

family:icedid banker loader trojan

Link:

https://tria.ge/reports/210330-hl5xmmbeme/

Behaviour

Suspicious behavior: EnumeratesProcesses

IcedID First Stage Loader

IcedID, BokBot

Malware Config

C2 Extraction:

usaaforced.fun

Unpacked files

SH256 hash:

56a48447a0e8f841f188f8f3ab6e88d1669937834249be56b078378e89e03fc2

MD5 hash:

424b5a23c3cadc04d7e8b99438721be1

SHA1 hash:

34ce17ec097faa4c0565eab32d9c0a251d02f1c9

Link:

https://www.unpac.me/results/0c684b0f-c16c-4a97-aa30-2f27b59ac90a/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

0.76

Link:

https://yomi.yoroi.company/submissions/56a48447a0e8f841f188f8f3ab6e88d1669937834249be56b078378e89e03fc2

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	crime_win32_icedid_stage1 Create hunting rule
Author:	Rony (@r0ny_123)
Description:	Detects IcedID Photoloader
Reference:	https://sysopfb.github.io/malware,/icedid/2020/04/28/IcedIDs-updated-photoloader.html