MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a61b1d70d469b8ca7acdbd26fc859e6aeb229c4636fe9c92eac856914f326ac8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


IcedID


Vendor detections: 8


Intelligence 8 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a61b1d70d469b8ca7acdbd26fc859e6aeb229c4636fe9c92eac856914f326ac8
SHA3-384 hash: cd9524960fe91c17bcf09e530272bdc4a59f993d7044bfdcdefa50be1f25bb4ab31c788b0fbe2814d70bce2b1c173463
SHA1 hash: 317dc24bd0601d237240084e4f939d707e5ff625
MD5 hash: b5240bcd8ea05ed12e9e8e51a09f25c3
humanhash: carbon-october-stream-edward
File name:SecuriteInfo.com.Trojan.Win64.Crypt.7196.2196
Download: download sample
Signature IcedID
Create hunting rule
File size:180'224 bytes
First seen:2022-01-28 09:01:50 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 616c436c7831fb3dbff4f23b2e172057 (2 x IcedID)
ssdeep 3072:J3lW6VPgwG7avse2xBz2Jyx0/x6Mpa0vL79:B3Vs7yb2niJNrP9
Threatray 151 similar samples on MalwareBazaar
TLSH T1C004901766EC7CDAD07286B0B77787C4C32EFC145660DA6E12D0124A5E7F2927E26BE0
File icon (PE):PE icon
dhash icon 6edbb12b17172b96 (10 x Quakbot, 9 x Heodo, 7 x BazaLoader)
Reporter SecuriteInfoCom
Tags:exe IcedID

Intelligence

File Origin
# of uploads :
1
# of downloads :
250
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
SecuriteInfo.com.Trojan.Win64.Crypt.7196.2196
Verdict:
No threats detected
Analysis date:
2022-01-28 11:07:36 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/5ba96cc2-8d04-4988-a380-adef74a19f51

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/224955/
Detection(s):
SecuriteInfo.com.Trojan.Win64.Crypt.7196.2196.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Searching for the window
DNS request
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/5399/overview
Behaviour
MalwareBazaar
CPUID_Instruction
MeasuringTime
CheckCmdLine
EvasionQueryPerformanceCounter
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
greyware wacatac
Link:
https://www.filescan.io/uploads/61f3b1146a7929f66a1ec947/reports/7b9a7ab8-9825-4022-bc27-b0d8986874fb/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Generic Malware
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/db50a4b6-5966-4c16-a65b-a770e0aaf988
Result
Threat name:
IcedID
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/929545
Signature
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Contains functionality to detect hardware virtualization (CPUID execution measurement)
Found malware configuration
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Sigma detected: Regsvr32 Network Activity
Sigma detected: Suspicious Call by Ordinal
System process connects to network (likely due to code injection or exploit)
Tries to detect virtualization through RDTSC time measurements
Yara detected IcedID
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 562023 Sample: SecuriteInfo.com.Trojan.Win... Startdate: 28/01/2022 Architecture: WINDOWS Score: 100 59 Multi AV Scanner detection for domain / URL 2->59 61 Found malware configuration 2->61 63 Antivirus detection for URL or domain 2->63 65 5 other signatures 2->65 7 loaddll64.exe 1 2->7         started        process3 dnsIp4 53 carpricegoods.com 7->53 55 tp.8e49140c2-frontier.amazon.com 7->55 57 2 other IPs or domains 7->57 73 Contains functionality to detect hardware virtualization (CPUID execution measurement) 7->73 75 Tries to detect virtualization through RDTSC time measurements 7->75 11 cmd.exe 1 7->11         started        13 regsvr32.exe 7->13         started        16 rundll32.exe 7->16         started        19 2 other processes 7->19 signatures5 process6 dnsIp7 21 rundll32.exe 11->21         started        77 Contains functionality to detect hardware virtualization (CPUID execution measurement) 13->77 79 Tries to detect virtualization through RDTSC time measurements 13->79 25 regsvr32.exe 13->25         started        29 tp.8e49140c2-frontier.amazon.com 16->29 31 dr49lng3n1n2s.cloudfront.net 16->31 33 aws.amazon.com 16->33 81 System process connects to network (likely due to code injection or exploit) 16->81 35 carpricegoods.com 185.81.114.99, 49687, 49688, 49689 HZ-NL-ASGB United Kingdom 19->35 37 tp.8e49140c2-frontier.amazon.com 19->37 39 5 other IPs or domains 19->39 27 conhost.exe 19->27         started        signatures8 process9 dnsIp10 41 carpricegoods.com 21->41 43 dr49lng3n1n2s.cloudfront.net 13.225.27.74, 443, 49684, 49685 AMAZON-02US United States 21->43 51 2 other IPs or domains 21->51 67 System process connects to network (likely due to code injection or exploit) 21->67 69 Contains functionality to detect hardware virtualization (CPUID execution measurement) 21->69 71 Tries to detect virtualization through RDTSC time measurements 21->71 45 carpricegoods.com 25->45 47 tp.8e49140c2-frontier.amazon.com 25->47 49 aws.amazon.com 25->49 signatures11
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a61b1d70d469b8ca7acdbd26fc859e6aeb229c4636fe9c92eac856914f326ac8/
Threat name:
Win64.Trojan.BazarLoader
Create hunting rule
Status:
Malicious
First seen:
2022-01-28 07:46:35 UTC
File Type:
PE+ (Dll)
Extracted files:
17
AV detection:
17 of 28 (60.71%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
icedid
Create hunting rule
Similar samples:
159596a25327a7ca8531fa0d326c3d80fac14b3732a6ec33e2ba5339fdbce9df
IcedID
32e52d829bbde235d7d00c6c1752f7ee5114de97eee59b22957d0adfab84c9e9
IcedID
6cf97e438fd5be6092a4337dc225ce9a134b5afe2c10638ab09deca00589b813
IcedID
6e486da9c8430de910b8d1f3c86b4f1dd787591232f854b3d1d77d39606014cb
IcedID
89aabd4ab6b696b3e9f74a04f27c4bc12f90b3a30855a403767ed525baec1736
IcedID
c40e0897a8c7bbd264df4fa44cc387efbc0de8e3bc834f5656f2291f920e1c5e
IcedID
dac397b4591408b3a46e7d5e112814a8a48c6a16fa5a9088013997caa6601d7c
IcedID
f7d6120e9efa0d813fb8916b1651a39b6301f3b6cc4734a531f4d98b35df38a9
IcedID
+ 141 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/220128-kzge1aagg6/
Unpacked files
SH256 hash:
a61b1d70d469b8ca7acdbd26fc859e6aeb229c4636fe9c92eac856914f326ac8
MD5 hash:
b5240bcd8ea05ed12e9e8e51a09f25c3
SHA1 hash:
317dc24bd0601d237240084e4f939d707e5ff625
Link:
https://www.unpac.me/results/f825172d-388c-4b4b-ba7e-473f06288041/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/a61b1d70d469b8ca7acdbd26fc859e6aeb229c4636fe9c92eac856914f326ac8

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

IcedID

Executable exe a61b1d70d469b8ca7acdbd26fc859e6aeb229c4636fe9c92eac856914f326ac8

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2011010/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/224955/

Comments