MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 691484e4df83d6f592a0ddebd8bd1afffc4568205a3b7f51c11c549124a1150c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


IcedID


Vendor detections: 7


Intelligence 7 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 691484e4df83d6f592a0ddebd8bd1afffc4568205a3b7f51c11c549124a1150c
SHA3-384 hash: 7ed7c6c5e55bbd1235efeccf17ddb0688df3f0ce08279a5645bf38a8b7b51181c9174c7fbb6aac08db65feb8cde8a22e
SHA1 hash: 0d1ce016532a16e2b302e2c733d2a941da14a712
MD5 hash: dea63acee01756034d57ed180d30d55b
humanhash: illinois-mars-sad-mars
File name:giigtb.exe
Download: download sample
Signature IcedID
Create hunting rule
File size:144'384 bytes
First seen:2020-09-11 19:43:59 UTC
Last seen:2020-09-11 20:43:42 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 2987c11657f01e3ac0640de00fb0c916 (2 x IcedID)
ssdeep 3072:VQUUHksew+bArSrW4h+ZtBSrSe/CfkB90vJF:vUEU+5rH/rSe/2kYRF
Threatray 574 similar samples on MalwareBazaar
TLSH F3E39D2175E18472E1BF46320870DB06076EBDA24B708DAB7BD8560EDE359D14E36BE3
Reporter malware_traffic
Tags:exe IcedID Shathak TA551

Intelligence

File Origin
# of uploads :
2
# of downloads :
205
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/58722/
Detection(s):
SecuriteInfo.com.Generic.mg.dea63acee0175603.22590.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Sending a UDP request
DNS request
Sending a custom TCP request
Result
Threat name:
Unknown
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/464552
Signature
Allocates memory in foreign processes
Contains functionality to detect hardware virtualization (CPUID execution measurement)
Contains VNC / remote desktop functionality (version string found)
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Early bird code injection technique detected
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Queues an APC in another process (thread injection)
Tries to detect virtualization through RDTSC time measurements
Writes to foreign memory regions
Behaviour
Behavior Graph:
Download SVG
Detection:
icedid
Create hunting rule
Link:
https://mwdb.cert.pl/sample/691484e4df83d6f592a0ddebd8bd1afffc4568205a3b7f51c11c549124a1150c/
Threat name:
Win32.Ransomware.WannaCry
Create hunting rule
Status:
Malicious
First seen:
2020-09-11 19:45:06 UTC
AV detection:
23 of 29 (79.31%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=nekijzg7qplpleva3xv5rpi2776ek2bali5x6uobdrkjcjfbcuga._file
Verdict:
malicious
Label(s):
gozi
Create hunting rule
icedid
Create hunting rule
Similar samples:
341621050c83b242a1779e5a88f4c6389b7efc1406d5e5ba8e7828a0d74fbb86
IcedID
4438467f45eedf09a6ddf01129a914bd3846bc7771bc15bfb512b85337b5d108
IcedID
58215823021c2da84fcf725bbb9b118aba9b72178577cba1d4c69545b9ae7fa2
IcedID
5bd66c88148005029d20c92e1d793f8d41f47a273a9334f9a85ec31148d0b040
IcedID
648fa862ce3d2230c2754a31f45d20b74f70d8648a9ad5897ba0d6a35627b592
IcedID
75195784a153205aad34eea77c000358081fd1e1c8abab6e532b2ae8e983c44b
IcedID
9ad02a119c0df3fb652557b2b5c3136a3fb7f80e78774f1bffd5237eb2d9a514
IcedID
d197285f37378d669afe2da7d3c60dcb93c118acf0d059d14ca67dcd73708ed2
IcedID
d748a00416baf3e4e5bf0a4e8312cd9c88872a6ab594628d7ff6d206e6705322
IcedID
e3be616e258172d4596cd61cbb6ec39b6e7aa0cf8138793783e21a4b6ab4c038
IcedID
+ 564 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/200911-fl6y3ecvjj/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Trojan
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/691484e4df83d6f592a0ddebd8bd1afffc4568205a3b7f51c11c549124a1150c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:crime_win32_banker_iceid_ldr1
Create hunting rule
Author:@VK_Intel
Description:Detects IcedId/BokBot png loader (unpacked)
Reference:twitter

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/58722/

Comments