MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 693ff483dc5f45b1f00cab0caea12d4cbc4923eeba39098247a759a550553eba. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


IcedID


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 693ff483dc5f45b1f00cab0caea12d4cbc4923eeba39098247a759a550553eba
SHA3-384 hash: 921d3237c7e49aff3dc71dd867f84718e9cfa9c06e866f1d63258239d5ed6c63edb4527fad28724056565eca665bd9c0
SHA1 hash: 6af7a0c185eb43c9cba05f59c648c6afba31d03b
MD5 hash: f6fee090fe6b4a40677e6ac212d39c86
humanhash: green-double-december-nitrogen
File name:unt8[1].dll
Download: download sample
Signature IcedID
Create hunting rule
File size:200'704 bytes
First seen:2020-07-23 13:40:39 UTC
Last seen:2020-07-23 14:39:01 UTC
File type:DLL dll
MIME type:application/x-dosexec
imphash 7c1f113f29efecc9d6def6c7b4072843 (2 x IcedID)
ssdeep 3072:SEKSeiJvJ/LLKjaVkUrSYxLjtao+i9+NKTGTan:S1uJ3AaVlFHaomKG
TLSH FE14BF0071C1C876EA4F037E8862DB35562B78598FB9D6C77BC49E8E5F761E19B32202
Reporter suspicious_link
Tags:IcedID

Intelligence

File Origin
# of uploads :
2
# of downloads :
112
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/31793/
Detection(s):
PUA.Win.Packer.PrivateExeProte-11
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Sending a custom TCP request
Result
Threat name:
IcedID
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
64 / 100
Link:
https://www.joesandbox.com/analysis/396385
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/693ff483dc5f45b1f00cab0caea12d4cbc4923eeba39098247a759a550553eba/
Threat name:
Win32.Infostealer.Dridex
Create hunting rule
Status:
Malicious
First seen:
2020-07-23 13:42:06 UTC
AV detection:
22 of 29 (75.86%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ne77ja64l5c3d4amvmgk5ijnjs6esi7oxi4qtashu5m2kucvh25a._file
Verdict:
unknown
Result
Malware family:
n/a
Score:
  8/10
Tags:
n/a
Link:
https://tria.ge/reports/200723-w4gfth988e/
Behaviour
Suspicious use of WriteProcessMemory
Suspicious behavior: EnumeratesProcesses
Modifies system certificate store
Suspicious use of WriteProcessMemory
Suspicious behavior: EnumeratesProcesses
Blacklisted process makes network request
Blacklisted process makes network request
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
ursnif3
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/693ff483dc5f45b1f00cab0caea12d4cbc4923eeba39098247a759a550553eba

File information

The table below shows additional information about this malware sample such as delivery method and external references.

IcedID

Word file doc 2f2404eaa1762c92ea08665e31ef57d6118f4e7572a0208bb102fa65c645cf95

IcedID

DLL dll 693ff483dc5f45b1f00cab0caea12d4cbc4923eeba39098247a759a550553eba

(this sample)

anyrun
any.run
https://app.any.run/tasks/d52f66be-14f1-47fc-ad3b-77c89c0e2b77/#
  
Dropped by
MD5 87e3a3829c723650bea2110ea75a43cd
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/31793/
  
Dropped by
SHA256 2f2404eaa1762c92ea08665e31ef57d6118f4e7572a0208bb102fa65c645cf95

Comments