MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a24c5d4c11f1d46b03ae1539df341c7247e1f8809b27a3b873449a1be218bd1e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


IcedID


Vendor detections: 6


Intelligence 6 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a24c5d4c11f1d46b03ae1539df341c7247e1f8809b27a3b873449a1be218bd1e
SHA3-384 hash: f51f1438072b31059084b0865bd6102a312dfa41876ab97f5737fbf2ab5f42b2f84109670de3f6f0b2e9235318531175
SHA1 hash: 2a5f4e1a20aa9f646303629dc19df06b347676f7
MD5 hash: 4459133ae1d27325db76fa2891230dfe
humanhash: nuts-alpha-lima-violet
File name:egdasu4.dll
Download: download sample
Signature IcedID
Create hunting rule
File size:310'784 bytes
First seen:2020-10-19 16:52:28 UTC
Last seen:2020-10-19 17:51:43 UTC
File type:DLL dll
MIME type:application/x-dosexec
imphash 86cfa1b93683e509c636e735c1cf53db (2 x IcedID)
ssdeep 6144:bEqQvGPPqCxZR3K/YzZ33pJeHKk2mfEhCZD7/ehjiSAOlh8:bEqAkPvjR3PDJ6Kk2mfZjehuSd8
Threatray 2 similar samples on MalwareBazaar
TLSH F1649E12B1D18473D67E86341824DBA51AFD7C210DA0EDAB6BD43A2F5E329C39734E72
Reporter malware_traffic
Tags:dll IcedID Shathak TA551

Intelligence

File Origin
# of uploads :
2
# of downloads :
133
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/73020/
Detection(s):
SecuriteInfo.com.W32.AIDetectVM.malware1.24202.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Sending a UDP request
Result
Threat name:
Unknown
Detection:
malicious
Classification:
troj.evad
Score:
72 / 100
Link:
https://www.joesandbox.com/analysis/495741
Signature
Allocates memory in foreign processes
Contains functionality to detect hardware virtualization (CPUID execution measurement)
Contains VNC / remote desktop functionality (version string found)
Queues an APC in another process (thread injection)
System process connects to network (likely due to code injection or exploit)
Tries to detect virtualization through RDTSC time measurements
Writes to foreign memory regions
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a24c5d4c11f1d46b03ae1539df341c7247e1f8809b27a3b873449a1be218bd1e/
Threat name:
Win32.Trojan.IcedID
Create hunting rule
Status:
Malicious
First seen:
2020-10-19 16:54:04 UTC
AV detection:
21 of 29 (72.41%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
icedid
Create hunting rule
Similar samples:
3dfb74874b9c0b32b66ce96a97170fc430fed51a7cfdbf361e6c4febe2935e5d
IcedID
56edc2e0d3d9cb181fc4d861cdbca6a960f576ce10d93f1a7ad18d80624185d5
IcedID
Result
Malware family:
icedid
Create hunting rule
Score:
  10/10
Tags:
trojan banker family:icedid
Link:
https://tria.ge/reports/201019-1g2a956s82/
Behaviour
Suspicious use of WriteProcessMemory
Blacklisted process makes network request
IcedID Core Payload
IcedID, BokBot
Unpacked files
SH256 hash:
45e7c9ebe7b303d1c6d1009a940059af20a1e6986355efc6ef9c1f2b2eb72f7d
MD5 hash:
2b2853ed114f385ad7ff249e0305da1e
SHA1 hash:
6cfb9b6437ac4f9f5687a667f42159e6f18ac919
Link:
https://www.unpac.me/results/4ce5ca97-160b-4ddb-bb54-13b917bb1bc7/
SH256 hash:
a24c5d4c11f1d46b03ae1539df341c7247e1f8809b27a3b873449a1be218bd1e
MD5 hash:
4459133ae1d27325db76fa2891230dfe
SHA1 hash:
2a5f4e1a20aa9f646303629dc19df06b347676f7
Link:
https://www.unpac.me/results/4ce5ca97-160b-4ddb-bb54-13b917bb1bc7/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/a24c5d4c11f1d46b03ae1539df341c7247e1f8809b27a3b873449a1be218bd1e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:crime_win32_banker_iceid_ldr1
Create hunting rule
Author:@VK_Intel
Description:Detects IcedId/BokBot png loader (unpacked)
Reference:twitter

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/73020/

Comments