MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7be97a8a8b5d1998868aeff9f0deba54482cd4c0d220423ed1f0ae3eb1442c27. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


IcedID


Vendor detections: 4


Intelligence 4 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7be97a8a8b5d1998868aeff9f0deba54482cd4c0d220423ed1f0ae3eb1442c27
SHA3-384 hash: 770787e2eb4637aa42f012c2d6595eb46a5204a53e5ef5fcd9430ad62b1a74a1d93d43d54dd9e567ee9795f94d8b5c5c
SHA1 hash: d5d8423937f9e3f2c11a36add83977422535bf7b
MD5 hash: 26705a3a1ed0a71689383eae8c3fcc61
humanhash: double-ten-zebra-freddie
File name:SecuriteInfo.com.Gen.NN.ZexaF.34108.xy1@amqiedE.8996
Download: download sample
Signature IcedID
Create hunting rule
File size:381'334 bytes
First seen:2020-05-05 02:48:53 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 56d6649bc6b8e7245fdedd2c3c139cbc (28 x IcedID)
ssdeep 3072:/drfV7YqW8waq6ciakIC/BwdrZ4P8Y5gla79yQ1yAnYgoFC3Wxl2G7mr3HWJtRIn:FrV7YqW83q6ciH/B6QZn8nTI
Threatray 846 similar samples on MalwareBazaar
TLSH 8D847B127BF0C076D69312314EB26B3992FDFC541F2295DB2799BB5D9D702C08A3A326
Reporter SecuriteInfoCom
Tags:IcedID

Intelligence

File Origin
# of uploads :
1
# of downloads :
87
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Gen.NN.ZexaF.34108.xy1@amqiedE.8996.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-05 03:37:05 UTC
File Type:
PE (Exe)
Extracted files:
30
AV detection:
23 of 31 (74.19%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
icedid
Create hunting rule
Similar samples:
104917afb9a75e03ba3bc996d2feeea3a684340524c739a46ff5a5867d9a9c52
IcedID
1fbede7e5ad40bf07aec1ad11f6fc4203c2cf2236c95dd5e81be4c742166054a
IcedID
33ee572238490c5fb2b183ebcbeeb67602dd1578aa2b8a4d189a735adc82d101
IcedID
7c1d83aabba5bd8f885c964e208071d7ad4577188ccb889a56a345495d4b7642
IcedID
8b282e9e0af37774a537540971ffc1aa49fffc3279d630bf11cd7a3ef54083f0
IcedID
932cbb5b3404052ae7865de3dda0a93c6906f83cfa3adaad3e027ceba2233b28
IcedID
b0baf7212475b749fa3bbc7f4eff08680bf3ae5602b154510e1979b5a69ab7af
IcedID
b16be1a60cfaee5eee0df3fde99ee17bbe6ee3a32de4b4786492966f4c006193
IcedID
c6fb63b8f9923126a10d8cdc2f8cdd5fb0ac2b5c76ffe41d8618f16097f31fce
IcedID
e13cd3e0597f4b7a641177eb56d8b1302490c06472a344d1663cd319fcae58cf
IcedID
+ 836 additional samples on MalwareBazaar
Result
Malware family:
icedid
Create hunting rule
Score:
  10/10
Tags:
family:icedid banker trojan
Link:
https://tria.ge/reports/201109-m95yxkry4j/
Behaviour
Suspicious use of SetWindowsHookEx
IcedID First Stage Loader
IcedID, BokBot
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Cobalt_functions
Create hunting rule
Author:@j0sm1
Description:Detect functions coded with ROR edi,D; Detect CobaltStrike used by differents groups APT

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

IcedID

Executable exe 7be97a8a8b5d1998868aeff9f0deba54482cd4c0d220423ed1f0ae3eb1442c27

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/357360/
  
Delivery method
Distributed via web download

Comments