MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a9691e506636f78293fac9fcdd9bfa1efb3c94b45452d0351ed8db489d65cee8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

IcedID

Vendor detections: 5

Intelligence 5 IOCs YARA 1 File information Comments

SHA256 hash:	a9691e506636f78293fac9fcdd9bfa1efb3c94b45452d0351ed8db489d65cee8
SHA3-384 hash:	78c5818d11f8589846f519a4cc7f9d63fb354f485c19a17844845b20b0a15d1da59dcbec51e290ae2bb63de71a82c808
SHA1 hash:	5246ccfee710e1c23a80e107761436c0e3fdc836
MD5 hash:	d6a173dbfd06a2223052431ef56d9e5c
humanhash:	papa-zebra-alpha-minnesota
File name:	SecuriteInfo.com.Gen.NN.ZexaF.34108.xy1@amqiedE.9449
Download:	download sample
Signature	IcedID Create hunting rule
File size:	381'319 bytes
First seen:	2020-05-05 02:50:34 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	56d6649bc6b8e7245fdedd2c3c139cbc (28 x IcedID)
ssdeep	3072:/drfV7YqW8waq6ciakIC/BwdrZ4P8Y5gla79yQ1yAnYgoFC3Wxl2G7mr3HWJtRIn:FrV7YqW83q6ciH/B6QZn8nTI
Threatray	846 similar samples on MalwareBazaar
TLSH	B8847B127BF0C076D69312314EB26B3992FDFC541F2295DB2799BB5D9D702C08A3A326
Reporter	SecuriteInfoCom
Tags:	IcedID

Intelligence

File Origin

# of uploads :

# of downloads :

140

Origin country :

n/a

Vendor Threat Intelligence

Detection(s):

SecuriteInfo.com.Gen.NN.ZexaF.34108.xy1@amqiedE.9449.UNOFFICIAL

Gathering data

Threat name:

Win32.Trojan.Kryptik

Status:

Malicious

First seen:

2020-05-05 01:00:55 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

23 of 31 (74.19%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=vfur4udgg33yfe72zh6n3g72d35tzffukrjnani63dnurhlfz3ua._file

Verdict:

malicious

Label(s):

icedid

Result

Malware family:

icedid

Score:

10/10

Tags:

family:icedid banker trojan

Link:

https://tria.ge/reports/201109-yrlhngw976/

Behaviour

Suspicious use of SetWindowsHookEx

IcedID First Stage Loader

IcedID, BokBot

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Cobalt_functions Create hunting rule
Author:	@j0sm1
Description:	Detect functions coded with ROR edi,D; Detect CobaltStrike used by differents groups APT

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

IcedID

exe a9691e506636f78293fac9fcdd9bfa1efb3c94b45452d0351ed8db489d65cee8

(this sample)

URLhaus

https://urlhaus.abuse.ch/url/357410/

URLhaus

https://urlhaus.abuse.ch/url/357485/

Delivery method

Distributed via web download

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample