🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7092d744817b17348172c00fe2bc3710794688fe34e200c9c4e7ab6d3ecfda02. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


IcedID


Vendor detections: 2


Intelligence 2 IOCs 1 YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7092d744817b17348172c00fe2bc3710794688fe34e200c9c4e7ab6d3ecfda02
SHA3-384 hash: a721c6f6eb2e20804ae19ccb9ab91548b416b935d54c3e15f161ccf219e5e108de60203d6989bf7352cc257f8cb39417
SHA1 hash: f5e91c14e40545dc98f677a01a44590c672884ef
MD5 hash: cb342cbe41e4892c0120c04078e57620
humanhash: oscar-finch-green-social
File name:redacted invoice 12.13.2022.zip
Download: download sample
Signature IcedID
Create hunting rule
File size:748'897 bytes
First seen:2022-12-13 20:30:05 UTC
Last seen:Never
File type: zip
MIME type:application/zip
Note:This file is a password protected archive. The password is: office13122022
ssdeep 12288:vvIqfXVQR4AVIRbV1ppF9LT1Q5elKUbjGQN/q1Coz0DW9U9RFtI:Y2VQRDCbVTpFxTi54KAjllABzsWq9/u
TLSH T1D7F423847F27E096013F906D4ABF5FA5AF21927B375CAC328EE08746F58DC60D0E9265
TrID 80.0% (.ZIP) ZIP compressed archive (4000/1)
20.0% (.PG/BIN) PrintFox/Pagefox bitmap (640x800) (1000/1)
Reporter k3dg3___
Tags:3407323965 IcedID pw office13122022 zip

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
estrabornhot.com https://threatfox.abuse.ch/ioc/1036813/

Intelligence

File Origin
# of uploads :
1
# of downloads :
206
Origin country :
US US
File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:soon_even.msi
File size:1'454'080 bytes
SHA256 hash: ebd022c7fed376881b90383028b0a6b18bc68f068cab5b4dadc57690612952e7
MD5 hash: e97dda068d2b38835208a41cadad4740
MIME type:application/x-msi
Signature IcedID
Vendor Threat Intelligence
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/7092d744817b17348172c00fe2bc3710794688fe34e200c9c4e7ab6d3ecfda02/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ocjnorebpmltjalsyah6fpbxcb4unch6gtrabsoe46vw2pwp3iba._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

IcedID

zip 7092d744817b17348172c00fe2bc3710794688fe34e200c9c4e7ab6d3ecfda02

(this sample)

68a083503a2de1e5f5c4709eb1a294157b27616cbb4f7941cc46ed0a1c1166ee

  
Link
https://tria.ge/221213-y4rcnaae7x
  
Dropping
SHA256 68a083503a2de1e5f5c4709eb1a294157b27616cbb4f7941cc46ed0a1c1166ee
  
Delivery method
Distributed via e-mail attachment

Comments