MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6a70d723e3137cbc6193ebe8bcf7a7df78fa83d9852a0ec8e172ba137ef6fd7a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


IcedID


Vendor detections: 6


Intelligence 6 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6a70d723e3137cbc6193ebe8bcf7a7df78fa83d9852a0ec8e172ba137ef6fd7a
SHA3-384 hash: 2646f9a9cbb38782c86b3bf07ed798ed6f076bc6445b30ca725c9a51ebb0afaa7bc13e5cdb423054e17af6a4232ace1f
SHA1 hash: 134c333f8ecceceb427a4078aa4fd56d14b63bb4
MD5 hash: ec0a315af92092c22c15eb8fcbb47349
humanhash: thirteen-seven-pluto-double
File name:6a70d723e3137cbc6193ebe8bcf7a7df78fa83d9852a0ec8e172ba137ef6fd7a
Download: download sample
Signature IcedID
Create hunting rule
File size:146'432 bytes
First seen:2020-11-15 22:44:25 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash 3097b1c5bba2e716be269c55c1f71681 (9 x IcedID)
ssdeep 3072:3gvlRW9mq+wpHPkTD/P0JDfT+u8L3lhiJo7A:3gvlA6w9kTQxLSq8A
Threatray 4 similar samples on MalwareBazaar
TLSH 5BE39D023290D076E9B742319864DF91577ABDA15F718E9737C46A4F9E322C08E36BE3
Reporter seifreed
Tags:IcedID

Intelligence

File Origin
# of uploads :
1
# of downloads :
110
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
Clean
Maliciousness:

Behaviour
Sending a UDP request
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6a70d723e3137cbc6193ebe8bcf7a7df78fa83d9852a0ec8e172ba137ef6fd7a/
Threat name:
Win32.Trojan.IcedID
Create hunting rule
Status:
Malicious
First seen:
2020-11-15 22:45:19 UTC
AV detection:
16 of 28 (57.14%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=njynoi7dcn6lyymt5pulz55h354pva6zquva5shbok5bg7xw7v5a._file
Verdict:
unknown
Similar samples:
2934ee71acf2ecf4b46532bdc0df7d12de3d2033a2d0a5ae4f42da5b0e571f92
IcedID
bdbc3850d100b517146a20b896e65eb2a411046a0520b20df39b518e7c451243
IcedID
ca8a6c634895059c5229d085b62814380d99df0abd699dcf2dbd7014f4a31714
IcedID
fe47d6df1dbba98481434048616e085c98555a8537964636aa54e9f30a8e38a5
IcedID
Result
Malware family:
icedid
Create hunting rule
Score:
  10/10
Tags:
family:icedid banker trojan
Link:
https://tria.ge/reports/201115-tx363e3ape/
Behaviour
Suspicious use of WriteProcessMemory
Blacklisted process makes network request
IcedID Core Payload
IcedID, BokBot
Unpacked files
SH256 hash:
6a70d723e3137cbc6193ebe8bcf7a7df78fa83d9852a0ec8e172ba137ef6fd7a
MD5 hash:
ec0a315af92092c22c15eb8fcbb47349
SHA1 hash:
134c333f8ecceceb427a4078aa4fd56d14b63bb4
Link:
https://www.unpac.me/results/d88d0ebd-f67f-4573-a1c1-ef871ecc8299/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/6a70d723e3137cbc6193ebe8bcf7a7df78fa83d9852a0ec8e172ba137ef6fd7a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:crime_win32_banker_iceid_ldr1
Create hunting rule
Author:@VK_Intel
Description:Detects IcedId/BokBot png loader (unpacked)
Reference:twitter

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other

Comments