🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5f032e0377fabc53bb43afcc859c8d7653caf5112dbc6bfa6f95a14401537edf. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


IcedID


Vendor detections: 5


Intelligence 5 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5f032e0377fabc53bb43afcc859c8d7653caf5112dbc6bfa6f95a14401537edf
SHA3-384 hash: b89771c7f0ead5e69331756e9eb1b812a451231c6f8ff8eb3496281190b2fc8c5039b937eca7b58606f8b250ff936ef2
SHA1 hash: 024546380727e94d9ab52ae6774da1bec3106120
MD5 hash: f851a61657f4adec5c38fcee6bd4a147
humanhash: beer-lima-louisiana-vermont
File name:demoscan-481.html
Download: download sample
Signature IcedID
Create hunting rule
File size:1'743'551 bytes
First seen:2022-10-10 08:09:59 UTC
Last seen:Never
File type: html
MIME type:text/html
ssdeep 24576:R42kr8bHFSEP6xnoSMv5swt0572ahsIZsz95ZM+VficvZN5kCmMOOGzb/1e1n7Mr:RkznMfnMuNOmn796rH
TLSH T1A28533411E124FBFCAAC8157602F4E5D9B623C41C12CE8D783EAF0DA066BB97451BE79
TrID 62.5% (.SMI/SMIL) Synchronized Multimedia Integration Language (5001/2/2)
37.4% (.HTML) HyperText Markup Language (3000/1/1)
Reporter proxylife
Tags:html IcedID

Intelligence

File Origin
# of uploads :
1
# of downloads :
247
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.26626.SvgHeur.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.JS.Obfus-2179.UNOFFICIAL
Create hunting rule

TwinWave.Encoder.Javascript_Obfuscator_Usage_Observed_M1.20220427.UNOFFICIAL
Create hunting rule

TwinWave.Encoder.Javascript_Obfuscator_Usage_Observed_M3.20220427.UNOFFICIAL
Create hunting rule

Verdict:
No Threat
Threat level:
  2/10
Confidence:
100%
Tags:
stealer
Link:
https://www.filescan.io/uploads/6343d35c81eef2a234c4aed0/reports/1b41a456-cd59-472b-aead-534416fb18bb/overview
Result
Threat name:
HtmlDropper
Create hunting rule
Detection:
malicious
Classification:
troj
Score:
48 / 100
Link:
https://www.joesandbox.com/analysis/1086751
Signature
Yara detected Html Dropper
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 719311 Sample: demoscan-481.html Startdate: 10/10/2022 Architecture: WINDOWS Score: 48 32 Yara detected Html Dropper 2->32 8 chrome.exe 18 8 2->8         started        11 chrome.exe 2->11         started        process3 dnsIp4 22 192.168.2.1 unknown unknown 8->22 24 239.255.255.250 unknown Reserved 8->24 13 unarchiver.exe 4 8->13         started        15 chrome.exe 8->15         started        process5 dnsIp6 18 7za.exe 2 13->18         started        26 clients.l.google.com 142.250.184.206, 443, 49700 GOOGLEUS United States 15->26 28 www.google.com 142.250.186.36, 443, 49704, 49730 GOOGLEUS United States 15->28 30 3 other IPs or domains 15->30 process7 process8 20 conhost.exe 18->20         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/5f032e0377fabc53bb43afcc859c8d7653caf5112dbc6bfa6f95a14401537edf/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=l4bs4a3x7k6fho2dv7gilhenozj4v5irfw6gx6tpswquiaktp3pq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
IcedID
Score:
0.90
Link:
https://yomi.yoroi.company/submissions/5f032e0377fabc53bb43afcc859c8d7653caf5112dbc6bfa6f95a14401537edf

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:adonunix2
Create hunting rule
Author:Tim Brown @timb_machine
Description:AD on UNIX
Rule name:BitcoinAddress
Create hunting rule
Author:Didier Stevens (@DidierStevens)
Description:Contains a valid Bitcoin address
Rule name:html_auto_download_b64
Create hunting rule
Author:Tdawg
Description:html auto download
Rule name:QbotStuff
Create hunting rule
Author:anonymous

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments