MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 97cee47dbde3ce0063fb5b930932aa8daa8d109e738984ecf61c05a04e76139f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


IcedID


Vendor detections: 6


Intelligence 6 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 97cee47dbde3ce0063fb5b930932aa8daa8d109e738984ecf61c05a04e76139f
SHA3-384 hash: 6a50935dd940cc43345b245097e159a97eeb64d106d9017561b787e720848cbd5f39b9c698c4084ad71da9b22a16bd6a
SHA1 hash: 43ace881f517119eebce516e89ed2109ae0658b6
MD5 hash: ed60a6026fa489abe5ecb88b9f020a4e
humanhash: friend-four-eight-xray
File name:maKtUe-dat.dll
Download: download sample
Signature IcedID
Create hunting rule
File size:318'464 bytes
First seen:2022-07-28 15:58:44 UTC
Last seen:2022-07-28 16:33:24 UTC
File type:Executable exe
MIME type:application/x-dosexec
ssdeep 6144:4pwf7MopfE2l6ncf0UqWJGGY7tuRo26AC5:4EnpfE2l6nBUVJGGY7tuRo23A
TLSH T17164F860F91130ADF233C076B0D1BD8B3229E553DA165EBAF22F79E9C6924D52233B15
TrID 63.5% (.EXE) Win64 Executable (generic) (10523/12/4)
12.2% (.EXE) OS/2 Executable (generic) (2029/13)
12.0% (.EXE) Generic Win/DOS Executable (2002/3)
12.0% (.EXE) DOS Executable Generic (2000/1)
Reporter Anonymous
Tags:dll exe IcedID

Intelligence

File Origin
# of uploads :
2
# of downloads :
385
Origin country :
n/a
Vendor Threat Intelligence
Detection:
IcedIDLoader
Create hunting rule
Link:
https://www.capesandbox.com/analysis/294956/
Detection(s):
SecuriteInfo.com.UDS.Trojan-Banker.Win32.IcedID.28101.21156.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Searching for the window
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/46439ab5-2384-43cc-9ebc-f9cc81bca6c2
Result
Threat name:
IcedID
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
84 / 100
Link:
https://www.joesandbox.com/analysis/1042639
Signature
C2 URLs / IPs found in malware configuration
Contains functionality to detect hardware virtualization (CPUID execution measurement)
Malicious sample detected (through community Yara rule)
System process connects to network (likely due to code injection or exploit)
Tries to detect virtualization through RDTSC time measurements
Yara detected IcedID
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/97cee47dbde3ce0063fb5b930932aa8daa8d109e738984ecf61c05a04e76139f/
Threat name:
Win64.Trojan.IcedID
Create hunting rule
Status:
Malicious
First seen:
2022-07-28 15:59:07 UTC
File Type:
PE+ (Dll)
AV detection:
10 of 26 (38.46%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=s7hoi7n54phaay73lojqsmvkrwvi2ee6ooeyj3hwdqc2attwcopq._file
Result
Malware family:
icedid
Create hunting rule
Score:
  10/10
Tags:
family:icedid campaign:3228035598 banker loader trojan
Link:
https://tria.ge/reports/220728-te21mshfhk/
Behaviour
Suspicious behavior: EnumeratesProcesses
Blocklisted process makes network request
IcedID, BokBot
Malware Config
C2 Extraction:
deficulintersun.com
Unpacked files
SH256 hash:
97cee47dbde3ce0063fb5b930932aa8daa8d109e738984ecf61c05a04e76139f
MD5 hash:
ed60a6026fa489abe5ecb88b9f020a4e
SHA1 hash:
43ace881f517119eebce516e89ed2109ae0658b6
Link:
https://www.unpac.me/results/97a2d52c-71ae-4ecb-ab01-2d0a0d85588c/
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:SPLCrypt
Create hunting rule
Author:James Quinn, Binary Defense
Description:Identifies SPLCrypt, a new crypter associated with Bazaloader

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/294956/

Comments