MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 948989af594ba4896284c729cc9a0b6d110d7d7a1960e00084a35076cf4a2fe7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


IcedID


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 948989af594ba4896284c729cc9a0b6d110d7d7a1960e00084a35076cf4a2fe7
SHA3-384 hash: 3045500d5c6d8c71716d29bfada200be73e92420ba7522bdbbed6d486a8f36be6b638ab5343d9ec801302616c577b396
SHA1 hash: 0b6f3fdd4108a216491d5d685324653a82f37ccd
MD5 hash: 32cad9c1869ff9da152a59e604aa7748
humanhash: alpha-east-mango-four
File name:948989af594ba4896284c729cc9a0b6d110d7d7a1960e00084a35076cf4a2fe7
Download: download sample
Signature IcedID
Create hunting rule
File size:144'384 bytes
First seen:2020-07-15 16:18:23 UTC
Last seen:2020-07-15 17:06:32 UTC
File type:DLL dll
MIME type:application/x-dosexec
imphash 01e959959a9d2aa736034c1c52b0b2ae (2 x IcedID, 1 x Gozi)
ssdeep 3072:59f/ubcZSGW7qyrIvTH2u38RCQzF+K2WWaIrExRMJd:5I4A57ZrIrWu38fp2WUFJd
Threatray 828 similar samples on MalwareBazaar
TLSH 55E3AF017A81D472E6BF1D390974E675073D3D20EBA48EAB77C42A7A5E700D0AE35E27
Reporter JAMESWT_WT
Tags:IcedID

Intelligence

File Origin
# of uploads :
2
# of downloads :
117
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/26089/
Detection(s):
SecuriteInfo.com.Gen.NN.ZedlaF.34136.iy8@aK6Xubki.4305.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
DNS request
Sending a custom TCP request
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/948989af594ba4896284c729cc9a0b6d110d7d7a1960e00084a35076cf4a2fe7/
Threat name:
Win32.Trojan.IcedID
Create hunting rule
Status:
Malicious
First seen:
2020-07-15 16:20:02 UTC
File Type:
PE (Dll)
AV detection:
20 of 29 (68.97%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=sseytl2zjosisyuey4u4zgqlnuiq27l2dfqoaaeeunihnt2kf7tq._file
Verdict:
malicious
Label(s):
icedid
Create hunting rule
gozi
Create hunting rule
Similar samples:
0aa2727753d68654ada04a86531c216b15754fe0fabb38bf5db9c9bd4d8933a8
IcedID
33a254d82ed46fb2c38d0ae52dbefb012fb3b9e61e7cd8ebb5f0163e4a635a3e
IcedID
4060134612ebdaae96a4dea94b5b876f7bfee97cd5d1e0e6f8659c71165cc476
IcedID
45100eae0d92ac2d1142ffd48e6b478c78ca3707601705e867e0e6597e385c5d
IcedID
60adb0a8bb01a52de96c31213433954834f2ca43b677ec67737ad12e633a5c18
IcedID
94349d76ec1a0c4f60d8d6b59e5dd0883a533a17c9a7c7a87cab5d4540e5d4ea
IcedID
a81aa093f5b1278af943f7b47498e2b3847394187e19a66b3bd5e6a302dc9e38
IcedID
bbd6bde5b8c92642cf6bf2cc0e3c64e41079b1a4a587423265fe9d589bf4d1f3
IcedID
e5f1b3c69e967ec1531a0fb923599009fd86a9667110079be0b8cf50360f4e8c
IcedID
e98b07ca60ea27b79f08543d4c6ab61b47366a5f49898622f2ee90f7d12ada55
IcedID
+ 818 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
n/a
Link:
https://tria.ge/reports/200715-1tk888d6p6/
Behaviour
Suspicious behavior: EnumeratesProcesses
Modifies system certificate store
Suspicious use of WriteProcessMemory
Suspicious use of WriteProcessMemory
Suspicious behavior: EnumeratesProcesses
Blacklisted process makes network request
Blacklisted process makes network request
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/26089/

Comments