MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6196a0966d3fbe5726736f0fd7661a0a928fdce345cb377e79cea039594a79f0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


IcedID


Vendor detections: 5


Intelligence 5 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6196a0966d3fbe5726736f0fd7661a0a928fdce345cb377e79cea039594a79f0
SHA3-384 hash: a03dbc243fa7b81bb5a45d16cee15b72a57713bfc0ec959f8e8645b3dcfaf5976b0aa61b88072b3d06f243ee58faff48
SHA1 hash: 583b57b0c60a640c908fbf37f1b50fcfab57a96d
MD5 hash: 4896a4b3071b13c65fefc4842464843b
humanhash: lion-mountain-uncle-purple
File name:111.jpg
Download: download sample
Signature IcedID
Create hunting rule
File size:371'714 bytes
First seen:2020-07-24 17:11:08 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash 4e9b9131f4160c5dc4ae908eed15b416 (4 x IcedID)
ssdeep 6144:MdMOmNDo0xxiR2BcDeP0PDcTeZJIUJgLdAA:MoDo0DiR2BcqP8DGerzA
Threatray 782 similar samples on MalwareBazaar
TLSH 90847D00EA90D039F4FF06B95A7685A9A9387DA0577CC4CF97C125AF1A346E2ED31B13
Reporter malware_traffic
Tags:dll IcedID Shathak TA551

Intelligence

File Origin
# of uploads :
1
# of downloads :
96
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/32243/
Detection(s):
PUA.Win.Packer.PrivateExeProte-11
Create hunting rule

PUA.Win.Downloader.Aiis-6803892-0
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Sending a custom TCP request
Result
Threat name:
IcedID
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
64 / 100
Link:
https://www.joesandbox.com/analysis/397580
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6196a0966d3fbe5726736f0fd7661a0a928fdce345cb377e79cea039594a79f0/
Threat name:
Win32.Worm.Cridex
Create hunting rule
Status:
Malicious
First seen:
2020-07-24 17:13:05 UTC
AV detection:
24 of 29 (82.76%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
icedid
Create hunting rule
gozi
Create hunting rule
Similar samples:
07fe977241ab3c72ac5653b08767c0aa6f8e37d89f292a9fcc5b30a4e407e68c
IcedID
539c339c67f87349e48c9c48faf7d38673f53f8fbf8ee5ba8f67a2f670092ba3
IcedID
6095525df3b44b1a3ed02aace8edfa6adce837e758ea859457f58fcff1d98095
IcedID
60cb915575571cb1875f15b6d19763bdf52535186c877867c1536e0df8c93fd9
IcedID
72140cd87c7b181794aaf13e8b01f1896c7dfdcd76292bbe11ff950a1630b036
IcedID
763045778cf8977b3da1f081ce871cf57570cfafa98d9d4c0334e554a0d77ac3
IcedID
8f0325a3648ae0bea65ba84f6157726c6b81b19daa9f6266863e4778823f95a0
IcedID
99d01c764171af578d6077e52788b0d75f181fdd4e80f2227ae2c473f5b3cca7
IcedID
ce6e51ab9d45e2555cec4cc21eae79584f23fe843c04313d6a2ffc21e0fddd49
IcedID
d9b40c2b268ff23981ec939f0b1d8e395df51e0545e1ada4fd1cc16b60c574b6
IcedID
+ 772 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
n/a
Link:
https://tria.ge/reports/200724-he6fb8dnc6/
Behaviour
Suspicious use of WriteProcessMemory
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Suspicious behavior: EnumeratesProcesses
Blacklisted process makes network request
Blacklisted process makes network request
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/6196a0966d3fbe5726736f0fd7661a0a928fdce345cb377e79cea039594a79f0

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:win_unidentified_023_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/32243/

Comments