🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a9f1cd6e939dc4c8870552ad52ec20bed38bdbfaa44fe0a04ba00b3e23e59a1d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


IcedID


Vendor detections: 11


Intelligence 11 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a9f1cd6e939dc4c8870552ad52ec20bed38bdbfaa44fe0a04ba00b3e23e59a1d
SHA3-384 hash: 0b992cc39d5057f2cc9682fe07e429e54cbb5b7512513f02cdedf576ca4ba174770b3cba3b6456b94e1484ca9f7d8996
SHA1 hash: 12fb276ed5ad7ed3bf3e0cc8e7a26080a7e3f2e0
MD5 hash: 1475b770c88ccfb850b6e95057969bc6
humanhash: wolfram-high-spring-november
File name:LisectAVT_2403002B_320.dll
Download: download sample
Signature IcedID
Create hunting rule
File size:81'920 bytes
First seen:2024-07-25 01:14:12 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 4f0c2c904283b81b81368f0a41d1a1ac (9 x IcedID, 2 x TrickBot)
ssdeep 768:pWadwr+b2aikC6DwLUslDgXBpH/zuVQX9pzvjU4YqsABzktk42mWhlzS8q:75ikC6DwLUHfzDX9JU4YK83Az9
TLSH T19D830AAA50D67BE9C0F40231C8550375C9370CC5072CE5FBFCA94F61AA34BBDA54AAB9
TrID 25.4% (.ICL) Windows Icons Library (generic) (2059/9)
25.0% (.EXE) OS/2 Executable (generic) (2029/13)
24.7% (.EXE) Generic Win/DOS Executable (2002/3)
24.7% (.EXE) DOS Executable Generic (2000/1)
Reporter Anonymous
Tags:exe IcedID


Avatar
Anonymous
this malware sample is very nasty!

Intelligence

File Origin
# of uploads :
1
# of downloads :
481
Origin country :
CN CN
Vendor Threat Intelligence
Detection(s):
Win.Packed.Generickdz-9944354-0
Create hunting rule

Gathering data
Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a file in the Windows subdirectories
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
icedid masquerade microsoft_visual_cc packed
Link:
https://www.filescan.io/uploads/66a1a71d3ba51bb345a37371/reports/259f79d6-f287-4071-913d-f841befeb1e2/overview
Malware family:
IcedID
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/fd481833-fa0d-4af8-8c92-988c90341bb6
Result
Threat name:
IcedID
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1481800
Behaviour
Behavior Graph:
n/a
Score:
99%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/a9f1cd6e939dc4c8870552ad52ec20bed38bdbfaa44fe0a04ba00b3e23e59a1d
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a9f1cd6e939dc4c8870552ad52ec20bed38bdbfaa44fe0a04ba00b3e23e59a1d/
Threat name:
Win64.Trojan.IcedID
Create hunting rule
Status:
Malicious
First seen:
2024-02-27 13:41:00 UTC
File Type:
PE+ (Sys)
AV detection:
28 of 38 (73.68%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=vhy423uttxcmrbyfkkwvf3bax3jyxw72urh6bicluaft4i7ftioq._file
Verdict:
malicious
Label(s):
icedid
Create hunting rule
Result
Malware family:
icedid
Create hunting rule
Score:
  10/10
Tags:
family:icedid campaign:358151332 banker loader trojan
Link:
https://tria.ge/reports/240725-bmbvbaygjj/
Behaviour
Suspicious behavior: EnumeratesProcesses
IcedID First Stage Loader
IcedID, BokBot
Malware Config
C2 Extraction:
azorropulseee.fun
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/3284c9f5-7f77-427e-a3fb-13b312810004
Unpacked files
SH256 hash:
a9f1cd6e939dc4c8870552ad52ec20bed38bdbfaa44fe0a04ba00b3e23e59a1d
MD5 hash:
1475b770c88ccfb850b6e95057969bc6
SHA1 hash:
12fb276ed5ad7ed3bf3e0cc8e7a26080a7e3f2e0
Link:
https://www.unpac.me/results/8cef0855-2fc8-4907-8bba-a528b72bc904/
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

IcedID

Executable exe a9f1cd6e939dc4c8870552ad52ec20bed38bdbfaa44fe0a04ba00b3e23e59a1d

(this sample)

  
Link
https://bbs.kafan.cn/forum-31-1.html
  
Delivery method
Distributed via e-mail attachment

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (GUARD_CF)high

Comments