MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a40bfbcfe67cfe4b2db3f7b7254a28a54847f3a82ebeffafd6ad8456d2605075. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	a40bfbcfe67cfe4b2db3f7b7254a28a54847f3a82ebeffafd6ad8456d2605075
SHA3-384 hash:	8412bbc6063c96930221a8d6ff8aec6ce1bcf14f66716592db7813e4015b80f73038c59d3f46b539e79998c40959d12d
SHA1 hash:	156bc239b85b74799e96629b3a1b41f78c45164c
MD5 hash:	c3e3cd8d4b637772580a9db31c2beb49
humanhash:	purple-eighteen-mountain-emma
File name:	Setup_Win_13-02-2023_16-33-14.rar
Download:	download sample
Signature	IcedID Alert Create hunting rule
File size:	127'550 bytes
First seen:	2023-02-14 12:14:29 UTC
Last seen:	Never
File type:	rar
MIME type:	application/x-rar
ssdeep	3072:roUimDiCnN8NNqFCya5VNcUqHqh0N1DV8:roU9pWqQ5VNcU/0jDV8
TLSH	T1E1C3D4343B4993EF41D6F6449B26F81D3F613E3E8919B2EAF7D25BCB468C854AC12520
TrID	61.5% (.RAR) RAR compressed archive (v5.0) (8000/1) 38.4% (.RAR) RAR compressed archive (gen) (5000/1)
Reporter	Vladisl51060804
Tags:	IcedID rar

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

122

Origin country :

CH

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

Relevant files 1

File name:	Setup_Win_13-02-2023_16-33-14.exe
File size:	742'701'568 bytes
SHA256 hash:	68fcd0ef08f5710071023f45dfcbbd2f03fe02295156b4cbe711e26b38e21c00
MD5 hash:	7327fb493431fa390203c6003bd0512f
MIME type:	application/x-dosexec
Signature	IcedID

Vendor Threat Intelligence

FileScan.IO Suspicious

Verdict:

Suspicious

Threat level:

  5/10

Confidence:

100%

Tags:

icedid large-file

Link:

https://www.filescan.io/uploads/63eb7b4755a8f3b961922de2/reports/aa3bcfcd-4b8a-431c-ae0b-f2666e467c81/overview

Hybrid Analysis Malicious

Verdict:

Malicious

Link:

https://www.hybrid-analysis.com/sample/a40bfbcfe67cfe4b2db3f7b7254a28a54847f3a82ebeffafd6ad8456d2605075

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/a40bfbcfe67cfe4b2db3f7b7254a28a54847f3a82ebeffafd6ad8456d2605075/

ReversingLabs TitaniumCloud Binary.Trojan.Hulk

Threat name:

Binary.Trojan.Hulk

Alert

Create hunting rule

Status:

Malicious

First seen:

2023-02-14 13:14:53 UTC

AV detection:

5 of 35 (14.29%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=uqf7xt7gpt7ewlnt663sksriuveep45if27p7l6wvwcfnutakb2q._file

Hatching Triage icedid

Result

Malware family:

icedid

Alert

Create hunting rule

Score:

  10/10

Tags:

family:icedid campaign:2076641214 banker loader trojan

Link:

https://tria.ge/reports/230214-p7g4qadd96/

Behaviour

Suspicious behavior: EnumeratesProcesses

IcedID, BokBot

Malware Config

C2 Extraction:

alishabrindeader.com

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/a40bfbcfe67cfe4b2db3f7b7254a28a54847f3a82ebeffafd6ad8456d2605075