MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 927a8d1445750400db3850d0b2dc3522b0f373098385373efa3d7762120f3689. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry



IcedID


Vendor detections: 5


Intelligence 5 IOCs YARA 1 File information Comments

SHA256 hash: 927a8d1445750400db3850d0b2dc3522b0f373098385373efa3d7762120f3689
SHA3-384 hash: 57b80889f143512c030945f339717e88d924cdf3ba1ef77c596d9dab9a5bc40cdcdda6de3111b0ca446b1681f99b69b0
SHA1 hash: 9d1a116f1407a818f93b07d9f3acf93c0c3dd104
MD5 hash: 4a19399fa5d13569446f562e45fca57a
humanhash: finch-bravo-early-kentucky
File name:927a8d1445750400db3850d0b2dc3522b0f373098385373efa3d7762120f3689
Download: download sample
Signature IcedID
File size:220'160 bytes
First seen:2020-06-03 15:01:58 UTC
Last seen:2020-06-05 10:07:53 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash b8b96c56613affec66230c4e3db1ee91 (25 x IcedID, 1 x TrickBot)
ssdeep 3072:ZTlccpug9oWl3lo3wvo9+a6uKKpjCUUKI9joN9pOxhrLuvj:Z2c3l1uw2PKI3UKFvEx5L
Threatray 1'138 similar samples on MalwareBazaar
TLSH A7248C0177C180B0D87A02350929AB91553EFCB14FB1676B2799BB9E5EB42C0BF357A3
Reporter @raashidbhatt
Tags:exe IcedID

Intelligence


File Origin
# of uploads :
5
# of downloads :
86
Origin country :
US US
Mail intelligence
No data
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Icedid
Status:
Malicious
First seen:
2020-06-01 14:36:11 UTC
AV detection:
23 of 31 (74.19%)
Threat level:
  5/5
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a

YARA Signatures


MalareBazaar uses YARA rules from several public and non-public repositories, such as Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious proccess dumps they may create. Please note that only results from TLP:WHITE rules are being displayeyd.

Rule name:Cobalt_functions
Author:@j0sm1
Description:Detect functions coded with ROR edi,D; Detect CobaltStrike used by differents groups APT

File information


The table below shows additional information about this malware sample such as delivery method and external references.

Comments