MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 927a8d1445750400db3850d0b2dc3522b0f373098385373efa3d7762120f3689. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


IcedID


Vendor detections: 4


Intelligence 4 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 927a8d1445750400db3850d0b2dc3522b0f373098385373efa3d7762120f3689
SHA3-384 hash: 57b80889f143512c030945f339717e88d924cdf3ba1ef77c596d9dab9a5bc40cdcdda6de3111b0ca446b1681f99b69b0
SHA1 hash: 9d1a116f1407a818f93b07d9f3acf93c0c3dd104
MD5 hash: 4a19399fa5d13569446f562e45fca57a
humanhash: finch-bravo-early-kentucky
File name:927a8d1445750400db3850d0b2dc3522b0f373098385373efa3d7762120f3689
Download: download sample
Signature IcedID
Create hunting rule
File size:220'160 bytes
First seen:2020-06-03 15:01:58 UTC
Last seen:2020-06-05 10:07:53 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash b8b96c56613affec66230c4e3db1ee91 (25 x IcedID, 1 x TrickBot)
ssdeep 3072:ZTlccpug9oWl3lo3wvo9+a6uKKpjCUUKI9joN9pOxhrLuvj:Z2c3l1uw2PKI3UKFvEx5L
Threatray 1'138 similar samples on MalwareBazaar
TLSH A7248C0177C180B0D87A02350929AB91553EFCB14FB1676B2799BB9E5EB42C0BF357A3
Reporter raashidbhatt
Tags:exe IcedID

Intelligence

File Origin
# of uploads :
5
# of downloads :
103
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Icedid
Create hunting rule
Status:
Malicious
First seen:
2020-06-01 14:36:11 UTC
AV detection:
23 of 31 (74.19%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=sj5i2fcfoucabwzykdilfxbvekypg4yjqoctopx2hv3weeqpg2eq._file
Verdict:
malicious
Label(s):
icedid
Create hunting rule
Similar samples:
08f3b51c8493c5ed8948ab35c956a465e0043094248d2f27a5d8fa9a696e3cbf
IcedID
278593e60722d691fe1b23b22cab15294662bbd2ef8ca1ba8e80ca78e872a813
IcedID
27c3f84dd3101c302afb523ee2c5b728c1fc34cfb8430c314d1f2df5ed79c28c
IcedID
302b22ef958f04eeef47eaef2fe2d2fd062a17c16683ec8f2cf0b899f19c2acb
IcedID
3700f2c5fe27c80e41984b2a55f236655a09f0781c05b265bccb26165318d78a
IcedID
5bd66c88148005029d20c92e1d793f8d41f47a273a9334f9a85ec31148d0b040
IcedID
8d1b83eff1b3c604365fd29de1bb43204852de842c0bb148975fe7a7485310e4
IcedID
aea1d064fb75706dd261f1097f91574050216410ce840e9c7523c46aca53c5f9
IcedID
e94e31beaf1c2a6c24f0973a621c8715faf91a18e8c7acdab8a832021c7ce5f5
IcedID
f3ba5d0b27ff406dcd1c624aee919f394d231b878f040ec23e36c7f0cf81df99
IcedID
+ 1'128 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/201109-b2w7zl9fbn/
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Cobalt_functions
Create hunting rule
Author:@j0sm1
Description:Detect functions coded with ROR edi,D; Detect CobaltStrike used by differents groups APT

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments