MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9a54e9abe080033e092065115052d11ab97a4aa59750b2fc7e3fa8a3dc3f6903. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

IcedID

Vendor detections: 6

Intelligence 6 IOCs 1 YARA 1 File information Comments

SHA256 hash:	9a54e9abe080033e092065115052d11ab97a4aa59750b2fc7e3fa8a3dc3f6903
SHA3-384 hash:	e9b87fdfc24dcc6a219d3f0e1e8e57a8f22ee5077447b6fecfdd184eec798f064aa314df00e3ac91a27e7fd94db67904
SHA1 hash:	4e3be191b655164fc13984facf1cb25d0b212dff
MD5 hash:	63ac68f222a0643713c9fec9378eb836
humanhash:	speaker-mountain-orange-seventeen
File name:	63ac68f222a0643713c9fec9378eb836.dll
Download:	download sample
Signature	IcedID Create hunting rule
File size:	55'840 bytes
First seen:	2021-03-31 19:40:55 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
ssdeep	1536:MhQeEn2s56EdRX096SioHkvr+LlXpFyrEU:MqRjH0Eptvr+FzxU
Threatray	95 similar samples on MalwareBazaar
TLSH	F3437CCAC9B20663C536A971C2F12B18D122B760F393AAFBD1483365C1526D0DB737A6
Reporter	abuse_ch
Tags:	dll IcedID

abuse_ch

IcedID C2:
oceanwaterfree34.xyz

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOC	ThreatFox Reference
oceanwaterfree34.xyz	https://threatfox.abuse.ch/ioc/6321/

Intelligence

File Origin

# of uploads :

# of downloads :

113

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

63ac68f222a0643713c9fec9378eb836.dll

Verdict:

No threats detected

Analysis date:

2021-03-31 21:21:48 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/21139768-1550-44db-bd02-54fc88624b49

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

IcedIDStage1

Link:

https://www.capesandbox.com/analysis/130040/

Result

Verdict:

Clean

Maliciousness:

Behaviour

DNS request

Sending a custom TCP request

Sending a UDP request

Result

Verdict:

UNKNOWN

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/9a54e9abe080033e092065115052d11ab97a4aa59750b2fc7e3fa8a3dc3f6903/

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=tjkotk7aqabt4cjamuivauwrdk4xusvfs5ilf7d6h6ukhxb7nebq._file

Verdict:

malicious

Result

Malware family:

icedid

Score:

10/10

Tags:

family:icedid banker loader trojan

Link:

https://tria.ge/reports/210331-dm5v4kdzsx/

Behaviour

Suspicious behavior: EnumeratesProcesses

IcedID First Stage Loader

IcedID, BokBot

Malware Config

C2 Extraction:

oceanwaterfree34.xyz

Unpacked files

SH256 hash:

9a54e9abe080033e092065115052d11ab97a4aa59750b2fc7e3fa8a3dc3f6903

MD5 hash:

63ac68f222a0643713c9fec9378eb836

SHA1 hash:

4e3be191b655164fc13984facf1cb25d0b212dff

Link:

https://www.unpac.me/results/71e87ca5-6499-439b-a969-619805f27d5b/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

0.80

Link:

https://yomi.yoroi.company/submissions/9a54e9abe080033e092065115052d11ab97a4aa59750b2fc7e3fa8a3dc3f6903

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	crime_win32_icedid_stage1 Create hunting rule
Author:	Rony (@r0ny_123)
Description:	Detects IcedID Photoloader
Reference:	https://sysopfb.github.io/malware,/icedid/2020/04/28/IcedIDs-updated-photoloader.html