MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9a09137e28cc0e5af606db45d95f1fb46e1024129eb065e2d854c7aecda82ba0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


IcedID


Vendor detections: 8


Intelligence 8 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9a09137e28cc0e5af606db45d95f1fb46e1024129eb065e2d854c7aecda82ba0
SHA3-384 hash: 3417d7f9c6bfcf0fdffb0e34146ceb1beb36325448844322d9a05cf2f4eac5f678ae0c272148465e56c818c43b587e93
SHA1 hash: c22e71d80e127a45c226698a81272d193b5d225d
MD5 hash: a347ee429c92e27439ae9bcf37cb420d
humanhash: foxtrot-fifteen-triple-asparagus
File name:1.dll
Download: download sample
Signature IcedID
Create hunting rule
File size:644'914 bytes
First seen:2022-02-04 14:27:55 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 01f87ec9e1e36146b71b7ffce4fd5fa9 (20 x IcedID)
ssdeep 12288:FTsor70Aeojgc4+o07OCi6HY7FpW0zm0pF:FTXjeojgc4+lDZY5pF
TLSH T1C7D4AF39636507B5E0739434C9734943C6F17CB117B095EBA3A1325A0E3BFE5A63AB22
Reporter JAMESWT_WT
Tags:exe IcedID

Intelligence

File Origin
# of uploads :
1
# of downloads :
284
Origin country :
n/a
Vendor Threat Intelligence
Detection:
IcedIDLoader
Create hunting rule
Link:
https://www.capesandbox.com/analysis/233039/
Detection(s):
SecuriteInfo.com.VHO.Trojan.Win32.Sdum.gen.29993.26950.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.VHO.Trojan.Win32.Sdum.gen.11852.3673.UNOFFICIAL
Create hunting rule

Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/5990/overview
Behaviour
SystemUptime
MeasuringTime
CheckCmdLine
EvasionQueryPerformanceCounter
EvasionGetTickCount
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/9a5ed56f-f8bb-4062-ab1f-35f42031495d
Result
Threat name:
Unknown
Detection:
suspicious
Classification:
n/a
Score:
28 / 100
Link:
https://www.joesandbox.com/analysis/933990
Signature
Sigma detected: Suspicious Call by Ordinal
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 566467 Sample: 1.dll Startdate: 04/02/2022 Architecture: WINDOWS Score: 28 19 Sigma detected: Suspicious Call by Ordinal 2->19 7 loaddll64.exe 1 2->7         started        process3 process4 9 cmd.exe 1 7->9         started        11 rundll32.exe 7->11         started        13 rundll32.exe 7->13         started        15 2 other processes 7->15 process5 17 rundll32.exe 9->17         started       
Gathering data
Threat name:
Win64.Trojan.IcedID
Create hunting rule
Status:
Malicious
First seen:
2022-02-04 14:28:13 UTC
File Type:
PE+ (Dll)
Extracted files:
7
AV detection:
17 of 28 (60.71%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=tierg7rizqhfv5qg3nc5sxy7wrxbajast2yglywyktd25tnifoqa._file
Result
Malware family:
icedid
Create hunting rule
Score:
  10/10
Tags:
family:icedid campaign:1732687004 banker persistence suricata trojan
Link:
https://tria.ge/reports/220204-rs1cvsbbgk/
Behaviour
Modifies data under HKEY_USERS
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Drops file in Windows directory
Sets service image path in registry
IcedID, BokBot
suricata: ET MALWARE Win32/IcedID Request Cookie
Malware Config
C2 Extraction:
keepfootbal.com
Unpacked files
SH256 hash:
9a09137e28cc0e5af606db45d95f1fb46e1024129eb065e2d854c7aecda82ba0
MD5 hash:
a347ee429c92e27439ae9bcf37cb420d
SHA1 hash:
c22e71d80e127a45c226698a81272d193b5d225d
Link:
https://www.unpac.me/results/89bdbccc-2859-4fa7-be4b-fb60dbfdd83a/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/9a09137e28cc0e5af606db45d95f1fb46e1024129eb065e2d854c7aecda82ba0

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/233039/

Comments