MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7b0290fdb87e425a869defb681c5fbbed330a000c0cdb6e8c9c52b0e8b1b5492. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

IcedID

Vendor detections: 6

Intelligence 6 IOCs YARA 1 File information Comments

SHA256 hash:	7b0290fdb87e425a869defb681c5fbbed330a000c0cdb6e8c9c52b0e8b1b5492
SHA3-384 hash:	d626bc18e3c9b39d08f5c3d2fb907d7847c7924188d38ae5cd2a11b98f20eea695c15d9a32f2febfafa7ede30f320172
SHA1 hash:	cd8ab780d35cc5b2b651b1e361c932871b56ea70
MD5 hash:	22f52089fd030b5f2c096631a61d5e01
humanhash:	skylark-fifteen-bacon-magazine
File name:	IcedID.dll
Download:	download sample
Signature	IcedID Create hunting rule
File size:	62'976 bytes
First seen:	2021-03-22 12:37:19 UTC
Last seen:	2021-03-29 14:53:03 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	4f0c2c904283b81b81368f0a41d1a1ac (9 x IcedID, 2 x TrickBot)
ssdeep	1536:iNlYOpw/KCaGcdvf+p6H6ldr1xh0f6xprl6i:iNlY3/KCadt+dzh0f6Drl6i
TLSH	65534B5F01E3176DC4F1443AC889435484736D06072DE6FFF4A64F62AA3869DEAC2AF9
Reporter	JAMESWT_WT
Tags:	dll IcedID

Intelligence

File Origin

# of uploads :

# of downloads :

153

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

IcedID.dll

Verdict:

No threats detected

Analysis date:

2021-03-22 12:39:31 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/5a685fb6-ed41-4f91-883a-85d630794346

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/125911/

Detection(s):

SecuriteInfo.com.Trojan.Win32.Wacatac.Bml.12108.22050.UNOFFICIAL

Result

Verdict:

Clean

Maliciousness:

Behaviour

Deleting a recently created file

Creating a file in the Windows subdirectories

Sending a UDP request

Result

Verdict:

UNKNOWN

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

IceID

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/bf78ee5c-445f-4a7e-b69a-0d4ebbcab533

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/7b0290fdb87e425a869defb681c5fbbed330a000c0cdb6e8c9c52b0e8b1b5492/

Threat name:

Win64.Backdoor.Andromeda

Status:

Malicious

First seen:

2021-03-22 12:38:06 UTC

File Type:

PE+ (Sys)

AV detection:

14 of 29 (48.28%)

Threat level:

5/5

Result

Malware family:

icedid

Score:

10/10

Tags:

family:icedid banker loader trojan

Link:

https://tria.ge/reports/210322-4fh3nf7jns/

Behaviour

Suspicious behavior: EnumeratesProcesses

IcedID First Stage Loader

IcedID, BokBot

Malware Config

C2 Extraction:

lightopridum2.website

Unpacked files

SH256 hash:

7b0290fdb87e425a869defb681c5fbbed330a000c0cdb6e8c9c52b0e8b1b5492

MD5 hash:

22f52089fd030b5f2c096631a61d5e01

SHA1 hash:

cd8ab780d35cc5b2b651b1e361c932871b56ea70

Link:

https://www.unpac.me/results/576e8bf4-2bc9-4c20-97c1-6736f5193f5e/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

0.76

Link:

https://yomi.yoroi.company/submissions/7b0290fdb87e425a869defb681c5fbbed330a000c0cdb6e8c9c52b0e8b1b5492

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	crime_win32_icedid_stage1 Create hunting rule
Author:	Rony (@r0ny_123)
Description:	Detects IcedID Photoloader
Reference:	https://sysopfb.github.io/malware,/icedid/2020/04/28/IcedIDs-updated-photoloader.html