MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 99d01c764171af578d6077e52788b0d75f181fdd4e80f2227ae2c473f5b3cca7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


IcedID


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 99d01c764171af578d6077e52788b0d75f181fdd4e80f2227ae2c473f5b3cca7
SHA3-384 hash: c35a9e57a8a5a3209c10b1bd14685bb87dbf172d70144c389bb91e8a86fc60dc705d0681faa56cfd2649ff3426a148f7
SHA1 hash: d650543847dcfe281a80a6da3d55a66cdfed8b2b
MD5 hash: 278f294b3b942649e438e274444fcd1f
humanhash: venus-quiet-nine-alanine
File name:main.jpg
Download: download sample
Signature IcedID
Create hunting rule
File size:120'834 bytes
First seen:2020-08-18 18:28:24 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash 373e3f2e657732d4744ca41638966ae3 (1 x IcedID)
ssdeep 1536:0xOoSs+molbwchvrCuA79CC5t7t/28W9EbsNCXxi3pkCXsW7Ycd2dqHg9Yn2c4:0CcolbwchDdAZt7tu8Iu3hw72+g9q2c4
Threatray 608 similar samples on MalwareBazaar
TLSH 11C37C40B4D1C070E1AE5D3D4835C6B29B7EB821DEA4AE9B279C062E1FB01D1DE36D67
Reporter malware_traffic
Tags:dll IcedID Shathak TA551

Intelligence

File Origin
# of uploads :
1
# of downloads :
158
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/47988/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
DNS request
Sending a custom TCP request
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/99d01c764171af578d6077e52788b0d75f181fdd4e80f2227ae2c473f5b3cca7/
Threat name:
Win32.Trojan.IcedID
Create hunting rule
Status:
Malicious
First seen:
2020-08-18 18:29:05 UTC
AV detection:
20 of 29 (68.97%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=thiby5sbogxvpdlao7sspcfq25prqh65j2apeit24lchh5ntzstq._file
Verdict:
malicious
Label(s):
icedid
Create hunting rule
gozi
Create hunting rule
Similar samples:
054ff4620aaa40928ca67a2c364bedf71d79672874d75ba50ff8231069ad74d9
IcedID
07fe977241ab3c72ac5653b08767c0aa6f8e37d89f292a9fcc5b30a4e407e68c
IcedID
60cb915575571cb1875f15b6d19763bdf52535186c877867c1536e0df8c93fd9
IcedID
6196a0966d3fbe5726736f0fd7661a0a928fdce345cb377e79cea039594a79f0
IcedID
72140cd87c7b181794aaf13e8b01f1896c7dfdcd76292bbe11ff950a1630b036
IcedID
763045778cf8977b3da1f081ce871cf57570cfafa98d9d4c0334e554a0d77ac3
IcedID
7d97f43bdac6a0420b701f622c164af9f6aed64cb5f3cdbdc3bc44088b0ac2d9
IcedID
8131a4efe8cd0df08b0dc44a83079aa0dd7cf88c39c85f5caa13b43a950f9a9b
IcedID
d9b40c2b268ff23981ec939f0b1d8e395df51e0545e1ada4fd1cc16b60c574b6
IcedID
e4f110ace5cc6e58d8959e08fe6d7680e78e653e9e4c1da80e9770e1acf63ac2
IcedID
+ 598 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
n/a
Link:
https://tria.ge/reports/200818-hehfnj8k3e/
Behaviour
Modifies system certificate store
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Blacklisted process makes network request
Blacklisted process makes network request
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Trojan
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/99d01c764171af578d6077e52788b0d75f181fdd4e80f2227ae2c473f5b3cca7

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/47988/

Comments