🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 669e69bc2a322d87cf3e21b3277f1a97ce550afb353074238b0be8faa317a82f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


IcedID


Vendor detections: 11


Intelligence 11 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 669e69bc2a322d87cf3e21b3277f1a97ce550afb353074238b0be8faa317a82f
SHA3-384 hash: 2522698b3d113f7e35bb93b7de60a1bc7ec0ae979b29a595c34e75e0a2d941b8d8b91c28981da2cc62fd0e2e8a99429f
SHA1 hash: 5fe0f2fe23f085efae59b0dc4cad6a00c7510a30
MD5 hash: 739a188549ee4d06e6740ec53fcac2c1
humanhash: november-queen-east-october
File name:sample1.bin
Download: download sample
Signature IcedID
Create hunting rule
File size:721'272 bytes
First seen:2022-10-01 10:13:22 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash fe8ac26a9e653c5408fbc7a4bbbb5cbb (1 x IcedID)
ssdeep 768:cvLOgNOAkfe7UxYaOa9QOTg4ey5o485ZGVNN+B/MOucI+onBdsiRvPniqWtHFMV8:KkfQ2YaJ9Q66R5ZG5OJVi3E
Threatray 54 similar samples on MalwareBazaar
TLSH T115E4B9863A28CB7FFA3445308D537EAF5BF2E065AD9682561040E76F8F243473394DA9
TrID 45.5% (.EXE) Win16 NE executable (generic) (5038/12/1)
18.3% (.EXE) OS/2 Executable (generic) (2029/13)
18.0% (.EXE) Generic Win/DOS Executable (2002/3)
18.0% (.EXE) DOS Executable Generic (2000/1)
Reporter Anonymous
Tags:exe IcedID unpacked

Intelligence

File Origin
# of uploads :
1
# of downloads :
346
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/315464/
Detection(s):
SecuriteInfo.com.Trojan.IcedID.113.21287.1814.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Sending a custom TCP request
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/40405/overview
Behaviour
MalwareBazaar
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
overlay shell32.dll
Link:
https://www.filescan.io/uploads/633812eb0d3d21420cc99810/reports/b9a6cfb9-1765-4664-803c-dbc9983e3f5d/overview
Malware family:
IcedID
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/327203cd-05cb-4968-949c-0cbc874e0a3f
Result
Threat name:
IcedID
Create hunting rule
Detection:
malicious
Classification:
troj
Score:
88 / 100
Link:
https://www.joesandbox.com/analysis/1081483
Signature
Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for domain / URL
Yara detected IcedID
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 714040 Sample: sample1.bin.exe Startdate: 01/10/2022 Architecture: WINDOWS Score: 88 17 Multi AV Scanner detection for domain / URL 2->17 19 Malicious sample detected (through community Yara rule) 2->19 21 Antivirus detection for URL or domain 2->21 23 4 other signatures 2->23 7 loaddll64.exe 1 2->7         started        process3 process4 9 cmd.exe 1 7->9         started        11 rundll32.exe 7->11         started        13 rundll32.exe 7->13         started        process5 15 rundll32.exe 9->15         started       
Detection:
icedid
Create hunting rule
Link:
https://mwdb.cert.pl/sample/669e69bc2a322d87cf3e21b3277f1a97ce550afb353074238b0be8faa317a82f/
Threat name:
Win64.Infostealer.Convagent
Create hunting rule
Status:
Malicious
First seen:
2022-10-01 10:14:08 UTC
File Type:
PE+ (Dll)
AV detection:
16 of 41 (39.02%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=m2pgtpbkgiwyptz6egzso7y2s7hfkcx3guyhii4lbpupviyxvaxq._file
Verdict:
malicious
Similar samples:
008a674e33435ce0b892d0a68ac6d01f9606c040da87b21a10ed069729ee04ff
IcedID
1a1b7f1832dfd1cc5fecac973821b4b179bb426b5d21c47343d516f0e4600165
IcedID
21285f6d8702236a5d8fad688ab0385e06fe0fe26493e19cbfab489340b897b1
IcedID
23c78e805bd910b9f4af543b4f6079b4f02241ed808cca9f76a42465a73e4811
IcedID
3055bfdc5fee78ad2b92fc4b1a35a4632a1f03152fc7e835a7f21d41e44aeb26
IcedID
91b51e17fbbea3524af6957c20345165ddc2d0aa60a0a1e1b283ac21c832b5ac
IcedID
ab841fb070572fe43b2f8ffa33780efb15024e1ae70007e3bf86a3e73c223ddb
IcedID
d45c78fa400b32c11443061dcd1c286d971881ddf35a47143e4d426a3ec6bffd
IcedID
fa735b1fa1424004597dbf72cad777ef94fb3a6776e16be52a61500b62cb06e9
IcedID
+ 44 additional samples on MalwareBazaar
Result
Malware family:
icedid
Create hunting rule
Score:
  10/10
Tags:
family:icedid botnet:3524611504 core_loader
Link:
https://tria.ge/reports/221001-l9mv7sfgg7/
Malware Config
C2 Extraction:
wronigrabs.com
nokainptisarda.com
Verdict:
Informative
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/5b1ac0cf-5c44-4636-a33b-69f47fabbcf1
Unpacked files
SH256 hash:
669e69bc2a322d87cf3e21b3277f1a97ce550afb353074238b0be8faa317a82f
MD5 hash:
739a188549ee4d06e6740ec53fcac2c1
SHA1 hash:
5fe0f2fe23f085efae59b0dc4cad6a00c7510a30
Link:
https://www.unpac.me/results/1c8d908e-3d2b-41a6-a5ee-fd3fa160a703/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/669e69bc2a322d87cf3e21b3277f1a97ce550afb353074238b0be8faa317a82f

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:IcedID_core_loader
Create hunting rule
Author:@bartblaze
Description:Identifies IcedID core loader.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/315464/

Comments