MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 866a63ec6d217e594a69b34bfe3a629c4eac3b6f117fe191df1a2bac3b4f5491. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

IcedID

Vendor detections: 3

Intelligence 3 IOCs YARA 1 File information Comments

SHA256 hash:	866a63ec6d217e594a69b34bfe3a629c4eac3b6f117fe191df1a2bac3b4f5491
SHA3-384 hash:	615e4b3d17202ca28a00667132e815de2a8931edc78ec8b15e86e1981b6e35072d9a71a681b8742a54349d463ab91f86
SHA1 hash:	3f20f4383dc471c5f4f17cf2077d8a34fb58fa49
MD5 hash:	ace8697c1a8a16b76a293e0ce648f487
humanhash:	arizona-triple-oscar-whiskey
File name:	Setup_Win_20-12-2022_13-48-52.iso
Download:	download sample
Signature	IcedID Create hunting rule
File size:	2'818'048 bytes
First seen:	2022-12-20 14:01:35 UTC
Last seen:	Never
File type:	iso
MIME type:	application/octet-stream
ssdeep	24576:CwkH3QY3UZp/g+/GomPS0AuYOW+EzI7L/Cge89x0Jh23NFEi:C5AMUHsJAuYOWnzGi89mJh2dFEi
TLSH	T179D52819E24378ABE796CD7085A653B3E530B4250F23687B3E9CDB742D6EE63011AF05
TrID	99.6% (.NULL) null bytes (2048000/1) 0.2% (.ATN) Photoshop Action (5007/6/1) 0.0% (.BIN/MACBIN) MacBinary 1 (1033/5) 0.0% (.ABR) Adobe PhotoShop Brush (1002/3) 0.0% (.SMT) Memo File Apollo Database Engine (88/84)
Reporter	stoerchl
Tags:	IcedID iso

Intelligence

File Origin

# of uploads :

# of downloads :

115

Origin country :

n/a

Vendor Threat Intelligence

Detection(s):

TwinWave.EvilLNK.PkillLOLBinWrapBattle.20220620.UNOFFICIAL

TwinWave.EvilLNK.ShowMe.20221215.UNOFFICIAL

Gathering data

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/866a63ec6d217e594a69b34bfe3a629c4eac3b6f117fe191df1a2bac3b4f5491/

Threat name:

Win32.Trojan.IcedID

Status:

Malicious

First seen:

2022-12-20 14:01:51 UTC

File Type:

Binary (Archive)

AV detection:

5 of 40 (12.50%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=qzvgh3dnef7fsstjwnf74otctrhkyo3pcf76deo7div2yo2pksiq._file

Gathering data

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/866a63ec6d217e594a69b34bfe3a629c4eac3b6f117fe191df1a2bac3b4f5491

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.