🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 65f7d58d0fc88e20c725d2a945ec6c3a6b80df590ae24c1a3a5534c1ebba6bbe. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


IcedID


Vendor detections: 2


Intelligence 2 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 65f7d58d0fc88e20c725d2a945ec6c3a6b80df590ae24c1a3a5534c1ebba6bbe
SHA3-384 hash: a292b05935db856d27b75b5afb7690bfbe3e0237837b67f18fa8429818392cfdd25faa7a0756a6d30c3c0bc3d6b61c4b
SHA1 hash: c5c9a28be184058a84e273997468bb22a0a64499
MD5 hash: c1a3409ddf59ef3efbee4a9ecccf5dc3
humanhash: oklahoma-iowa-stairway-california
File name:24aed1f8-3cfa-4e07-b47d-31809150f056.zip
Download: download sample
Signature IcedID
Create hunting rule
File size:1'223'289 bytes
First seen:2022-10-08 08:51:28 UTC
Last seen:Never
File type: zip
MIME type:application/zip
Note:This file is a password protected archive. The password is: GVRRb
ssdeep 24576:Ek1Pp8z1O6AjgrrOZn8ZTMCWULl64VP5uCmuzGPC0S0dYQZbD:Egx/PMriZn8JMrU046wXv0dY6n
TLSH T16E4533DB6A975E9385BDB3F2C5E11765B30E590A0EBB55FF3670E400BA0E52868F01C8
TrID 80.0% (.ZIP) ZIP compressed archive (4000/1)
20.0% (.PG/BIN) PrintFox/Pagefox bitmap (640x800) (1000/1)
Reporter 0xToxin
Tags:3400778916 GVRRb IcedID sincaplox-com zip

Intelligence

File Origin
# of uploads :
1
# of downloads :
274
Origin country :
n/a
File Archive Information

This file archive contains 3 file(s), sorted by their relevance:

File name:notice-d1bd56cb-774d-4613-a2e5-eda15181f583.lnk
File size:2'002 bytes
SHA256 hash: 2d89cc3cd4284d0b8b71d5b91172064f5f6c59c849c6eb0741542bbd363b9056
MD5 hash: c0471cafac9ff1eec4e98e55c5b6dff1
MIME type:application/octet-stream
Signature IcedID
File name:2cb02275-b3dd-422b-8734-1bdf2a220d00.png
File size:983'715 bytes
SHA256 hash: 9c21cf92159d804970aa6f4619e8e0447ffa4567af18e02df6a2d0d38d1dcbbb
MD5 hash: 24126d3e06d98e2fd3988f4f4de925b2
MIME type:image/png
Signature IcedID
File name:a5491204-40e9-4ebc-8c21-7a00bb0162d3.f9g
File size:745'472 bytes
SHA256 hash: a594cbbf8fb32f11751742eda0d5aa1d01577894667693777268d959a4a3dfc2
MD5 hash: 332cbf8e46aabce7e0b6676982d62a08
MIME type:application/x-dosexec
Signature IcedID
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.GenericKD.62621337.17802.174.UNOFFICIAL
Create hunting rule

Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/65f7d58d0fc88e20c725d2a945ec6c3a6b80df590ae24c1a3a5534c1ebba6bbe/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=mx35ldipzchcbrzf2kuul3dmhjvybx2zblreygr2ku2md252no7a._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/65f7d58d0fc88e20c725d2a945ec6c3a6b80df590ae24c1a3a5534c1ebba6bbe

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Execution_in_LNK
Create hunting rule
Author:@bartblaze
Description:Identifies execution artefacts in shortcut (LNK) files.
Rule name:EXE_in_LNK
Create hunting rule
Author:@bartblaze
Description:Identifies executable artefacts in shortcut (LNK) files.
Rule name:LNK_sospechosos
Create hunting rule
Author:Germán Fernández
Description:Detecta archivos .lnk sospechosos
Rule name:QbotStuff
Create hunting rule
Author:anonymous
Rule name:SUSP_LNK_CMD
Create hunting rule
Author:SECUINFRA Falcon Team
Description:Detects the reference to cmd.exe inside an lnk file, which is suspicious

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments