MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7cc29f497f0bf94c939879d269ac44d0cb925f9b4dbb3175be47293775265f14. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


IcedID


Vendor detections: 6


Intelligence 6 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7cc29f497f0bf94c939879d269ac44d0cb925f9b4dbb3175be47293775265f14
SHA3-384 hash: 34072a403b2cf23ed0feb69ed5946a7ff26f863383ba34ebe9f884c03dea69c0bcb434b7dd65247b7903b8400a907db2
SHA1 hash: ca75daf447f28ca9b4ed99bc3b1b8bcf3a65cdb8
MD5 hash: 12d631f48dd510f15a42fed249c20648
humanhash: oven-washington-dakota-zulu
File name:Jiexmomm.exe
Download: download sample
Signature IcedID
Create hunting rule
File size:282'624 bytes
First seen:2020-09-14 16:27:58 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 724da8aaabe1380fe2651f0051c2deac (2 x IcedID)
ssdeep 3072:SOoHlm32akQAoRWyxSF5Um0sMlW1sgg3JDVdopKXYdKCDRVtcmOnqG6e+ojw5uSs:HMmAognWm0JlWOggPBcE6Fuvnu6
Threatray 29 similar samples on MalwareBazaar
TLSH 5754AE1277F1C873D6A701328DE29BFBB2B5FD604E318B472391AB1EED314919926361
Reporter malware_traffic
Tags:exe IcedID Shathak TA551

Intelligence

File Origin
# of uploads :
1
# of downloads :
136
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/59392/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
Creating a window
DNS request
Sending a custom TCP request
Connection attempt
Result
Threat name:
Unknown
Detection:
malicious
Classification:
troj.evad
Score:
72 / 100
Link:
https://www.joesandbox.com/analysis/465625
Signature
Allocates memory in foreign processes
Contains functionality to detect hardware virtualization (CPUID execution measurement)
Contains VNC / remote desktop functionality (version string found)
Early bird code injection technique detected
Queues an APC in another process (thread injection)
Tries to detect virtualization through RDTSC time measurements
Writes to foreign memory regions
Behaviour
Behavior Graph:
Download SVG
Detection:
icedid
Create hunting rule
Link:
https://mwdb.cert.pl/sample/7cc29f497f0bf94c939879d269ac44d0cb925f9b4dbb3175be47293775265f14/
Threat name:
Win32.Trojan.IcedID
Create hunting rule
Status:
Malicious
First seen:
2020-09-14 16:29:05 UTC
AV detection:
19 of 29 (65.52%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
icedid
Create hunting rule
trickbot
Create hunting rule
Similar samples:
4438467f45eedf09a6ddf01129a914bd3846bc7771bc15bfb512b85337b5d108
IcedID
5bc0e27e86d9a4d5e7005669c12b97b56a42ac17fb5cc93de24f38527b5e97e1
IcedID
654e574fb479af0a9f8d277ed12f2d86681b76b4cfe63d7c9e774f5144be8801
IcedID
691484e4df83d6f592a0ddebd8bd1afffc4568205a3b7f51c11c549124a1150c
IcedID
a7978b617720e11d5261589226e6c16135dbe67f7b3212b2cbf523ca81ecc812
IcedID
d748a00416baf3e4e5bf0a4e8312cd9c88872a6ab594628d7ff6d206e6705322
IcedID
e3be616e258172d4596cd61cbb6ec39b6e7aa0cf8138793783e21a4b6ab4c038
IcedID
e70e28b0f0fd9ca707dcc37e2ef5e28f81d3f8fb27892f80a92f7f3093df1869
IcedID
f9e63320c3a3c14847155de9abdbbf38e44866500402d8985312d92f149df23b
IcedID
fd9ed4c7107c4fb86d348d13f7e6c3b6c23e6c12084adc45ddfef4bc2ef2fbaf
IcedID
+ 19 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/200914-pte67xdx9j/
Behaviour
Suspicious use of SetWindowsHookEx
Suspicious use of SetWindowsHookEx
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Cobalt_functions
Create hunting rule
Author:@j0sm1
Description:Detect functions coded with ROR edi,D; Detect CobaltStrike used by differents groups APT
Rule name:crime_win32_banker_iceid_ldr1
Create hunting rule
Author:@VK_Intel
Description:Detects IcedId/BokBot png loader (unpacked)
Reference:twitter
Rule name:win_sisfader_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/59392/

Comments