MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 595349f2bee834c22d2fce1f640d6fd089df862daafeaeb388bc2f1b79b53002. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

IcedID

Vendor detections: 13

Intelligence 13 IOCs YARA 10 File information Comments

SHA256 hash:	595349f2bee834c22d2fce1f640d6fd089df862daafeaeb388bc2f1b79b53002
SHA3-384 hash:	0a28c50c0e1f4fee384e3ff2d1d741e077ea93c34e6bd47058e0fe6a66458e1e385aa302e1653c88bf592e9202bcc93d
SHA1 hash:	b42e39beb04f4b02a83a300e7d7567e7ce9388ef
MD5 hash:	d9765495d7cedcadac21fdfa5d4355ab
humanhash:	bakerloo-angel-purple-zebra
File name:	INV-Details-JUL2023(124).exe
Download:	download sample
Signature	IcedID Create hunting rule
File size:	458'416 bytes
First seen:	2023-07-25 07:26:46 UTC
Last seen:	2023-07-25 08:32:19 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	06f25df4360c0ab9ee30cbac816de0f4 (5 x IcedID)
ssdeep	6144:SWuzrM1ukesfTqAYVTuFOBTfh3SVOFJzlBSFHds79zAADpgSHK6BdunGa:S3zwukBCiFel3tFJz6DeDpgSHKUMnD
Threatray	1'213 similar samples on MalwareBazaar
TLSH	T108A425C6BA56F8F9CBF3C076E45123363D0DF9D144A09E724761C3BA6C24818A86EDB5
TrID	41.1% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5) 26.1% (.EXE) Win64 Executable (generic) (10523/12/4) 12.5% (.EXE) Win16 NE executable (generic) (5038/12/1) 5.1% (.ICL) Windows Icons Library (generic) (2059/9) 5.0% (.EXE) OS/2 Executable (generic) (2029/13)
Reporter	JAMESWT_WT
Tags:	1561373935 exe IcedID signed

Code Signing Certificate

Organisation:	KOZUZ SP. Z O.O.
Issuer:	Certum Extended Validation Code Signing 2021 CA
Algorithm:	sha256WithRSAEncryption
Valid from:	2023-05-18T11:35:48Z
Valid to:	2024-05-17T11:35:47Z
Serial number:	2a2f270535c2d5e7630720fb229b5d1c
Intelligence:	12 malware samples on MalwareBazaar are signed with this code signing certificate
MalwareBazaar Blocklist:	This certificate is on the MalwareBazaar code signing certificate blocklist (CSCB)
Cert Graveyard Blocklist:	This certificate is on the Cert Graveyard blocklist
Thumbprint Algorithm:	SHA256
Thumbprint:	73a0cc4495a49492806b970fd844a0ab078126930305d22c7bf68b43c337fc1a
Source:	This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin

# of uploads :

# of downloads :

366

Origin country :

Vendor Threat Intelligence

Malware family:

icedid

ID:

File name:

INV-Details-JUL2023(124).exe

Verdict:

Malicious activity

Analysis date:

2023-07-25 07:46:51 UTC

Tags:

icedid bokbot

Link:

https://app.any.run/tasks/1f30b633-bba4-455f-9c9e-0681f8bdf858

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

IcedIDLoader

Link:

https://www.capesandbox.com/analysis/432012/

Detection(s):

SecuriteInfo.com.Win64.BotX-gen.19640.25953.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Sending a custom TCP request

DNS request

Sending an HTTP GET request

Gathering data

Verdict:

Suspicious

Labled as:

Win64/TrojanDownloader.IcedId

Link:

https://www.hybrid-analysis.com/sample/595349f2bee834c22d2fce1f640d6fd089df862daafeaeb388bc2f1b79b53002

Malware family:

GzipLoader

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/ce637a33-ada7-43c3-bfc2-18cd6c8c9fd9

Result

Threat name:

IcedID

Detection:

malicious

Classification:

troj.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1278904

Signature

Antivirus detection for URL or domain

C2 URLs / IPs found in malware configuration

Contains functionality to detect hardware virtualization (CPUID execution measurement)

Found API chain indicative of debugger detection

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Tries to detect virtualization through RDTSC time measurements

Yara detected IcedID

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/595349f2bee834c22d2fce1f640d6fd089df862daafeaeb388bc2f1b79b53002/

Threat name:

Win64.Trojan.IcedID

Status:

Malicious

First seen:

2023-07-25 07:25:38 UTC

File Type:

PE+ (Exe)

AV detection:

17 of 24 (70.83%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=lfjut4v65a2meljpzypwidlp2ce57brnvl7k5m4ixqxrw6nvgaba._file

Verdict:

malicious

Label(s):

icedid

IcedID

81f727c48ff93a829b40efa9c62b37113be526091e112e813b4e1997f9c33f85

IcedID

846dab665df0dd1febc5244482b955bf39dc92b80cee4561e0747b3d3c88a12c

IcedID

a015f40cfa1ca770c0c7fa901974ad6178f2b913659aea1486fcc307fd735e8e

IcedID

a07a7e40ff88008ef3a3150aa45733e2ca380508c1165ec75fc2bf52cc9a9d3c

IcedID

c7b4796751027b3049df6c795519f861bc5ac50410324fdff9a315d498dddee9

IcedID

d033105288280266f0336365245e18984c5fc684577beed5ad7430775ecd7c02

IcedID

+ 1'203 additional samples on MalwareBazaar

Result

Malware family:

icedid

Score:

10/10

Tags:

family:icedid campaign:1561373935 banker loader trojan

Link:

https://tria.ge/reports/230725-h94beaca9w/

Behaviour

Suspicious behavior: EnumeratesProcesses

IcedID, BokBot

Malware Config

C2 Extraction:

filtaferamoza.com

Unpacked files

SH256 hash:

595349f2bee834c22d2fce1f640d6fd089df862daafeaeb388bc2f1b79b53002

MD5 hash:

d9765495d7cedcadac21fdfa5d4355ab

SHA1 hash:

b42e39beb04f4b02a83a300e7d7567e7ce9388ef

Link:

https://www.unpac.me/results/ab57fecc-9a7c-437e-a572-6dd95903103d/

Malware family:

IcedID

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/595349f2bee8/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/595349f2bee834c22d2fce1f640d6fd089df862daafeaeb388bc2f1b79b53002

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	crime_win32_icedid_stage1 Create hunting rule
Author:	Rony (@r0ny_123)
Description:	Detects IcedID photoloader
Reference:	https://sysopfb.github.io/malware,/icedid/2020/04/28/IcedIDs-updated-photoloader.html

Rule name:	IcedIDLoader Create hunting rule
Author:	kevoreilly, threathive, enzo, r0ny123
Description:	IcedID Loader

Rule name:	IcedID_init_loader Create hunting rule
Author:	@bartblaze
Description:	Identifies IcedID (stage 1 and 2, initial loaders).

Rule name:	MALWARE_Win_IceID Create hunting rule
Author:	ditekSHen
Description:	Detects IceID / Bokbot variants

Rule name:	meth_get_eip Create hunting rule
Author:	Willi Ballenthin

Rule name:	PE_Digital_Certificate Create hunting rule
Author:	albertzsigovits

Rule name:	reverse_http Create hunting rule
Author:	CD_R0M_
Description:	Identify strings with http reversed (ptth)

Rule name:	Windows_Trojan_IcedID_0b62e783 Create hunting rule
Author:	Elastic Security

Rule name:	Windows_Trojan_IcedID_91562d18 Create hunting rule
Author:	Elastic Security

Rule name:	win_photoloader_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	Detects win.photoloader.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/432012/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample