MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b1b6ca3dd3d6ef951acc6d0fb2b30b9d82d2f7d29deffd3b4346d0fba522a485. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


IcedID


Vendor detections: 7


Intelligence 7 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b1b6ca3dd3d6ef951acc6d0fb2b30b9d82d2f7d29deffd3b4346d0fba522a485
SHA3-384 hash: ecf3c694fe455ed17337bc4fc34716c79cb9e71115b7983d3fc6efd64b4935da49be8c1dd4afc7942bc5775eee9fdfd2
SHA1 hash: 257cac81f1445896059d2d228b42e3c909bca097
MD5 hash: 1519a2dbe2f250a807f8c1b99ee3fc38
humanhash: mobile-cat-september-mexico
File name:SecuriteInfo.com.Variant.Mikey.116711.25037.867
Download: download sample
Signature IcedID
Create hunting rule
File size:134'656 bytes
First seen:2020-11-14 00:39:29 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash 14a49883c83ac5c80b38772e4632181d (3 x IcedID)
ssdeep 3072:Dn47Fjg3bql2O94QDQt+QC+uFkoQzJDw8URT:gTl2JTC7EZUR
Threatray 841 similar samples on MalwareBazaar
TLSH B9D38C0232909475F2BF1BFD04668A1147BEBCA1DFB099C7BBD4295EAA361C05E31B53
Reporter SecuriteInfoCom
Tags:IcedID

Intelligence

File Origin
# of uploads :
1
# of downloads :
231
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Variant.Mikey.116711.25037.867.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
DNS request
Sending a custom TCP request
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
IcedID
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
72 / 100
Link:
https://www.joesandbox.com/analysis/534394
Signature
Contains functionality to detect hardware virtualization (CPUID execution measurement)
Multi AV Scanner detection for submitted file
Tries to detect virtualization through RDTSC time measurements
Yara detected IcedID
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b1b6ca3dd3d6ef951acc6d0fb2b30b9d82d2f7d29deffd3b4346d0fba522a485/
Threat name:
Win32.Trojan.IcedID
Create hunting rule
Status:
Malicious
First seen:
2020-11-13 22:17:53 UTC
AV detection:
22 of 29 (75.86%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
icedid
Create hunting rule
Similar samples:
33d4b93f27fa6d5f68443a35b0640269b3f6a1cfd8e0015361e462bc369b0133
IcedID
4d00dd3d606e59496069e836b1c4466d5a11a1a03c2207947f64e4442099657a
IcedID
50b55b6f0ece35b30db3ceac5a06c37a39141d4419dac0c2b08cb6fd4de15dcb
IcedID
54a1ff16fd63ead406eec7b18303d4998ff43c078dc8c4257d6ba593a3e3b24d
IcedID
79d585b28d8211b54994c24243d7051ca849e2104d1aa08b50584ef36b359d59
IcedID
b25c8c35e0e2a69aa6b02ffd44e3117a4a103b626ea85ea77771ff35efd9449b
IcedID
b5399025d73dfb850df68017dfa81ce5f83bd9eeb7db056fffeca55ad3bcea65
IcedID
ddcf95d87542f2df67aff8941fcd92c71cc704698b00923791e21285f82bb01a
IcedID
e78cec26b2161c90b29869ab28fe59fc8224de56dc231cb7164bfbb043642f87
IcedID
ecfe29ac7905d40cd43e79c1ade25e12c3d01827a49f4a6a7abbea2b65eae839
IcedID
+ 831 additional samples on MalwareBazaar
Result
Malware family:
icedid
Create hunting rule
Score:
  10/10
Tags:
family:icedid banker trojan
Link:
https://tria.ge/reports/201114-kchxrqld6s/
Behaviour
Modifies system certificate store
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Blacklisted process makes network request
IcedID, BokBot
Unpacked files
SH256 hash:
b1b6ca3dd3d6ef951acc6d0fb2b30b9d82d2f7d29deffd3b4346d0fba522a485
MD5 hash:
1519a2dbe2f250a807f8c1b99ee3fc38
SHA1 hash:
257cac81f1445896059d2d228b42e3c909bca097
Link:
https://www.unpac.me/results/8ee11209-2f4b-4885-ad67-69d3dbdd148d/
SH256 hash:
1ce0c0bde6b14157d4d300956f2c6cfc31480ecf2645a9f157174ab6fcf33b6c
MD5 hash:
33c638bf9a04442c26fe683de1963135
SHA1 hash:
7d15c8cb239a3e42019a05eeedcb43cd79915813
Link:
https://www.unpac.me/results/8ee11209-2f4b-4885-ad67-69d3dbdd148d/
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

IcedID

DLL dll b1b6ca3dd3d6ef951acc6d0fb2b30b9d82d2f7d29deffd3b4346d0fba522a485

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/814971/
  
Delivery method
Distributed via web download

Comments