MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a3fa68045d0106d6db3d43df6b5997d9034f9f7d2a34148187498e4b504ebf58. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


IcedID


Vendor detections: 19


Intelligence 19 IOCs YARA 10 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a3fa68045d0106d6db3d43df6b5997d9034f9f7d2a34148187498e4b504ebf58
SHA3-384 hash: efa33eb3c36a3010eea63317453545e5cb18e61090686f101a346b0d8d473cb0a2e8ef489b532ab48d4ea6ec5ccf7b88
SHA1 hash: 585cfc19bdb8dfb92407e917615be1ab9dd523e5
MD5 hash: 06cc2fdfd408c15a1e16adfb46e8bb38
humanhash: river-apart-charlie-west
File name:svchost_icedid_unpacked.bin
Download: download sample
Signature IcedID
Create hunting rule
File size:16'320 bytes
First seen:2024-03-12 22:17:59 UTC
Last seen:2024-03-28 16:15:15 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash c8c62b0edf4a5f76dfd31e8262b5adbe (1 x IcedID)
ssdeep 192:6P+nM5KC/zxayGc3gzq7YjDaqzJCueT+RfbZne9s6PLRP0tkYGijY5:s5Jxayczq7Yjt9lfle9s6PL16kYGi85
Threatray 1'419 similar samples on MalwareBazaar
TLSH T15172399E232105CCD0BBC679C5951A27E2F278684623861F10E4CEAF5F277226E6EF15
TrID 38.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
15.6% (.ICL) Windows Icons Library (generic) (2059/9)
15.4% (.EXE) OS/2 Executable (generic) (2029/13)
15.2% (.EXE) Generic Win/DOS Executable (2002/3)
15.2% (.EXE) DOS Executable Generic (2000/1)
Reporter techevo_
Tags:exe IcedID injected PE


Avatar
techevo_
PE file is injected into remote process by https://bazaar.abuse.ch/sample/e1d2c95eda751901a4bdae7ba381b85f5d7965b05afe245b5cbaccce9ecfb0bc/

Intelligence

File Origin
# of uploads :
2
# of downloads :
618
Origin country :
GB GB
Vendor Threat Intelligence
Malware family:
icedid
Create hunting rule
ID:
1
File name:
a3fa68045d0106d6db3d43df6b5997d9034f9f7d2a34148187498e4b504ebf58.exe
Verdict:
Malicious activity
Analysis date:
2024-03-13 05:36:51 UTC
Tags:
icedid
Link:
https://app.any.run/tasks/b339bf50-84fb-44b0-aad0-a3fc689ac912

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
IcedIDLoader
Create hunting rule
Link:
https://www.capesandbox.com/analysis/478822/
Detection(s):
Win.Keylogger.Icedid-9984865-0
Create hunting rule

Win.Keylogger.Icedid-9984866-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
anti-vm icedid lolbin masquerade overlay shell32
Link:
https://www.filescan.io/uploads/65f0d49a5cd908a33db041b2/reports/a94adc82-4e28-4dba-a78d-9695dac4ed28/overview
Verdict:
Malicious
Labled as:
Tedy.Generic
Link:
https://www.hybrid-analysis.com/sample/a3fa68045d0106d6db3d43df6b5997d9034f9f7d2a34148187498e4b504ebf58
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
GzipLoader
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/b8b881d7-7456-4b60-838f-8d95150bde23
Result
Threat name:
IcedID
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1407877
Signature
Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Contains functionality to detect hardware virtualization (CPUID execution measurement)
Found malware configuration
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Tries to detect virtualization through RDTSC time measurements
Yara detected IcedID
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1407877 Sample: svchost_icedid_unpacked.bin.exe Startdate: 12/03/2024 Architecture: WINDOWS Score: 100 22 podiumstrtss.com 2->22 24 Found malware configuration 2->24 26 Malicious sample detected (through community Yara rule) 2->26 28 Antivirus detection for URL or domain 2->28 30 5 other signatures 2->30 8 loaddll64.exe 1 2->8         started        signatures3 process4 signatures5 32 Tries to detect virtualization through RDTSC time measurements 8->32 11 rundll32.exe 8->11         started        14 cmd.exe 1 8->14         started        16 rundll32.exe 8->16         started        18 conhost.exe 8->18         started        process6 signatures7 34 Contains functionality to detect hardware virtualization (CPUID execution measurement) 11->34 36 Tries to detect virtualization through RDTSC time measurements 11->36 20 rundll32.exe 14->20         started        process8
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/a3fa68045d0106d6db3d43df6b5997d9034f9f7d2a34148187498e4b504ebf58
Detection:
icedid
Create hunting rule
Link:
https://mwdb.cert.pl/sample/a3fa68045d0106d6db3d43df6b5997d9034f9f7d2a34148187498e4b504ebf58/
Threat name:
Win64.Trojan.IcedID
Create hunting rule
Status:
Malicious
First seen:
2024-03-12 22:18:04 UTC
File Type:
PE+ (Dll)
AV detection:
20 of 24 (83.33%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=up5gqbc5aednnwz5ippwwwmx3ebu7h35fi2bjamhjghewucox5ma._file
Verdict:
malicious
Similar samples:
14dbb4164d72baf15834966b4213023d2879cd9d5bedbac7e0e925ca4c4211b1
IcedID
265c1857ac7c20432f36e3967511f1be0b84b1c52e4867889e367c0b5828a844
IcedID
2b317f6a1ffc33b390ef0f9ca4c7227c250dc6e46e9eb198e2ef56ce00e0d360
IcedID
95ad74c1dff5293c49c955a4e77c17e6912c7b8d1fc8f5f4c6f05ac77a56a9ab
IcedID
99dfb7baafec050861e152a036af86fc0c7663f3c719d58a56dfd9f06f4b8cef
IcedID
b1d89aa18cd6e5e8e007713b1f79ae72238e85211c19d403b02ace2eac464e67
IcedID
f0bd3ee5f750d9bff17c13acfcdd96ab42e194319d766053104dee666b58e7bb
IcedID
+ 1'409 additional samples on MalwareBazaar
Result
Malware family:
icedid
Create hunting rule
Score:
  10/10
Tags:
family:icedid campaign:4165079571 loader
Link:
https://tria.ge/reports/240312-17xpysec38/
Behaviour
Suspicious behavior: EnumeratesProcesses
Malware Config
C2 Extraction:
podiumstrtss.com
Unpacked files
SH256 hash:
a3fa68045d0106d6db3d43df6b5997d9034f9f7d2a34148187498e4b504ebf58
MD5 hash:
06cc2fdfd408c15a1e16adfb46e8bb38
SHA1 hash:
585cfc19bdb8dfb92407e917615be1ab9dd523e5
Detections:
IcedIDLoader
Create hunting rule
win_photoloader_auto
Create hunting rule
win_photoloader_a0
Create hunting rule
win_iceid_gzip_ldr_202104
Create hunting rule
IcedID_init_loader
Create hunting rule
MAL_IcedID_GZIP_LDR_202104
Create hunting rule
Link:
https://www.unpac.me/results/42f5158b-6a42-42e0-b3b7-db8feb4b4bb9/
Malware family:
IcedID
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/a3fa68045d01/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/a3fa68045d0106d6db3d43df6b5997d9034f9f7d2a34148187498e4b504ebf58

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:crime_win32_icedid_stage1
Create hunting rule
Author:Rony (@r0ny_123)
Description:Detects IcedID photoloader
Reference:https://sysopfb.github.io/malware,/icedid/2020/04/28/IcedIDs-updated-photoloader.html
Rule name:IcedIDLoader
Create hunting rule
Author:kevoreilly, threathive, enzo, r0ny123
Description:IcedID Loader
Rule name:IcedID_init_loader
Create hunting rule
Author:@bartblaze
Description:Identifies IcedID (stage 1 and 2, initial loaders).
Rule name:MAL_IcedID_GZIP_LDR_202104
Create hunting rule
Author:Thomas Barabosch, Telekom Security
Description:2021 initial Bokbot / Icedid loader for fake GZIP payloads
Reference:https://www.telekom.com/en/blog/group/article/let-s-set-ice-on-fire-hunting-and-detecting-icedid-infections-627240
Rule name:Windows_Trojan_IcedID_0b62e783
Create hunting rule
Author:Elastic Security
Reference:https://www.elastic.co/security-labs/thawing-the-permafrost-of-icedid-summary
Rule name:Windows_Trojan_IcedID_11d24d35
Create hunting rule
Author:Elastic Security
Reference:https://www.elastic.co/security-labs/thawing-the-permafrost-of-icedid-summary
Rule name:Windows_Trojan_IcedID_48029e37
Create hunting rule
Author:Elastic Security
Reference:https://www.elastic.co/security-labs/thawing-the-permafrost-of-icedid-summary
Rule name:Windows_Trojan_IcedID_91562d18
Create hunting rule
Author:Elastic Security
Reference:https://www.elastic.co/security-labs/thawing-the-permafrost-of-icedid-summary
Rule name:win_iceid_gzip_ldr_202104
Create hunting rule
Author:Thomas Barabosch, Telekom Security
Description:2021 initial Bokbot / Icedid loader for fake GZIP payloads
Rule name:win_photoloader_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.photoloader.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Executable exe e1d2c95eda751901a4bdae7ba381b85f5d7965b05afe245b5cbaccce9ecfb0bc

IcedID

Executable exe a3fa68045d0106d6db3d43df6b5997d9034f9f7d2a34148187498e4b504ebf58

(this sample)

  
Dropped by
SHA256 e1d2c95eda751901a4bdae7ba381b85f5d7965b05afe245b5cbaccce9ecfb0bc
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/478822/
  
Dropped by
MD5 6779daf60f7aa4bc357b264f32ff6cde

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (NX_COMPAT)high
CHECK_NXMissing Non-Executable Memory Protectioncritical
Reviews
IDCapabilitiesEvidence
WIN32_PROCESS_APICan Create Process and ThreadsWINHTTP.dll::WinHttpCloseHandle
KERNEL32.dll::CloseHandle
KERNEL32.dll::CreateThread
WIN_BASE_APIUses Win Base APIKERNEL32.dll::LoadLibraryA
WIN_BASE_IO_APICan Create FilesKERNEL32.dll::CreateDirectoryA
KERNEL32.dll::CreateFileA
KERNEL32.dll::GetTempPathA
WIN_BASE_USER_APIRetrieves Account InformationADVAPI32.dll::GetUserNameW
ADVAPI32.dll::LookupAccountNameW
WIN_HTTP_APIUses HTTP servicesWINHTTP.dll::WinHttpConnect
WINHTTP.dll::WinHttpOpen
WINHTTP.dll::WinHttpOpenRequest
WINHTTP.dll::WinHttpQueryDataAvailable
WINHTTP.dll::WinHttpQueryHeaders
WINHTTP.dll::WinHttpReadData

Comments