MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b0c1d323520821d5cb14ea42b06f12fce42e40f04266e73ec7015dc31adf8540. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	b0c1d323520821d5cb14ea42b06f12fce42e40f04266e73ec7015dc31adf8540
SHA3-384 hash:	9bb86daf5bfc6a56343ed5c183119b97e58cd5f05d62cb23e3ac83262d6491760858d935157bcb3d27301434d763f4ef
SHA1 hash:	ca3b687bd71277d81f1baee9f08286d1c7732e78
MD5 hash:	9611e2142d1aa6792f97c8f4daa1ec38
humanhash:	dakota-fish-may-hamper
File name:	Setup_Win_19-01-2023_17-34-48.zip
Download:	download sample
Signature	IcedID Alert Create hunting rule
File size:	811'341 bytes
First seen:	2023-01-19 17:42:16 UTC
Last seen:	Never
File type:	zip
MIME type:	application/zip
ssdeep	3072:aStPESYAeHgFtbhfJsCxIv9uPBglr1ROhlMDRdNZ2Ok:a8M/AFphfJFG9SBOROEdrZ2Ok
TLSH	T1280512027A800976D7CCDBBF58F86639165A38E098F32FC8603924B5DF2D9665E8D513
TrID	80.0% (.ZIP) ZIP compressed archive (4000/1) 20.0% (.PG/BIN) PrintFox/Pagefox bitmap (640x800) (1000/1)
Reporter	malware_traffic
Tags:	BokBot file-pumped IcedID zip

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

149

Origin country :

US

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

Relevant files 1

File name:	Setup_Win_19-01-2023_17-34-46.exe
Pumped file	This file is pumped. MalwareBazaar has de-pumped it.
File size:	734'213'232 bytes
SHA256 hash:	cf21b4f0015bb55c8d3e3ec0f2bd03f3eda615e4f38aca1caa6270cb5d52b239
MD5 hash:	dc57823d0b7175750e33537e8fa4544a
De-pumped file size:	199'168 bytes (Vs. original size of 734'213'232 bytes)
De-pumped SHA256 hash:	2b46f2a650718271dad5a664ea47283a03637b4794825e1d6c295bdba05a28f2
De-pumped MD5 hash:	68c9874a81ea664eab647896d940ca4e
MIME type:	application/x-dosexec
Signature	IcedID

Vendor Threat Intelligence

FileScan.io

Gathering data

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/b0c1d323520821d5cb14ea42b06f12fce42e40f04266e73ec7015dc31adf8540/

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=wda5gi2sbaq5lsyu5jbla3ys7tsc4qhqijtoopwhafo4ggw7qvaa._file

Hatching Triage icedid

Result

Malware family:

icedid

Alert

Create hunting rule

Score:

  10/10

Tags:

family:icedid campaign:1420576768 banker loader trojan

Link:

https://tria.ge/reports/230119-xytedsea5v/

Behaviour

Suspicious behavior: EnumeratesProcesses

IcedID, BokBot

Malware Config

C2 Extraction:

plutoheadingo.com

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI IcedID

Threat name:

IcedID

Score:

0.90

Link:

https://yomi.yoroi.company/submissions/b0c1d323520821d5cb14ea42b06f12fce42e40f04266e73ec7015dc31adf8540