MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b225c3f7f23b2952c54b5d6f7b68f5b90fceb57465e552be33da54e375aab57a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


IcedID


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b225c3f7f23b2952c54b5d6f7b68f5b90fceb57465e552be33da54e375aab57a
SHA3-384 hash: b99a7fb2983dfa8705865d1ad360daa3f80daa1a1275f0170136fdca6cca954ec7edab71d87ca9122fbe48d726c21c4a
SHA1 hash: 6afa3ecec6d5490126af834abdc2ab9219158235
MD5 hash: 5be6d2af11eef5264ecc51697c510cd7
humanhash: bakerloo-twenty-juliet-foxtrot
File name:2020-07-14-DLL-for-IcedID-installer-example-03-of-18.bin
Download: download sample
Signature IcedID
Create hunting rule
File size:162'816 bytes
First seen:2020-07-15 08:19:54 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash e8fbd6da0d38f3c7dc051ba3209cd26f (17 x IcedID)
ssdeep 3072:jByDMAeNBxKlc5Sh2Y0ylyCAK0u3q33U3A3ymr+rvo:jBS6B0lU2T0PKI3k3An+rvo
Threatray 794 similar samples on MalwareBazaar
TLSH 96F38B05BA40C071D5BE1D384931D7AA0B7D7C30EFD19A8B77C42A6E1EB12D0AD35EA6
Reporter JAMESWT_WT
Tags:dll IcedID IceID

Intelligence

File Origin
# of uploads :
1
# of downloads :
104
Origin country :
n/a
Vendor Threat Intelligence
Detection:
IcedID
Create hunting rule
Link:
https://www.capesandbox.com/analysis/25914/
Detection(s):
SecuriteInfo.com.Generic.mg.24d47cc0b22d2461.22329.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
DNS request
Sending a custom TCP request
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b225c3f7f23b2952c54b5d6f7b68f5b90fceb57465e552be33da54e375aab57a/
Threat name:
Win32.Trojan.IcedID
Create hunting rule
Status:
Malicious
First seen:
2020-07-15 05:59:04 UTC
File Type:
PE (Dll)
Extracted files:
26
AV detection:
21 of 29 (72.41%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=wis4h57shmuvfrkllvxxw2hvxeh45nlumxsvfprt3jkog5nkwv5a._file
Verdict:
malicious
Label(s):
icedid
Create hunting rule
gozi
Create hunting rule
Similar samples:
11e539a659db77e56b85608659f513e4f97b2b2d6a757b4376141eeecd3728f5
IcedID
135aecd78ba525b2cbb5547b3e43d5713fd43e3e5a9c14452fc6e25ce85998fc
IcedID
6fede71248803463757ea05e875e0cdb97d38245c0d28597639aa797a90987ce
IcedID
a421e1ac6cd39b7709d8929329b2135cb0f1eaea48edc296d03f0b3f41058282
IcedID
a59ac4ed7c883d86bac18305763a43e86438455f259560f21fe30a10c2adb6b8
IcedID
a8967cdcb91ea12285cd9f365ef73895bf90283dbc00f197cfb49cec3c8c3886
IcedID
c1a91bfb28f0b216ccb04c7b704dfb4167a2e498cbd4c10bb954529608033aba
IcedID
c7fd1d9a9cd1fd3351c43763d262ba441d725ad6e34f6a842edb8ce77ac7a614
IcedID
ea01f383b43070155d6ce02e6123e53f4aa29488b087f631c9ee4c8afa9da674
IcedID
ffb08f27fe1710bc42fed4f350c79885d1a176111b9e4fdcc0b077cb2fe983a7
IcedID
+ 784 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
n/a
Link:
https://tria.ge/reports/200715-kgdq1c223e/
Behaviour
Suspicious use of WriteProcessMemory
Suspicious behavior: EnumeratesProcesses
Modifies system certificate store
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Blacklisted process makes network request
Blacklisted process makes network request
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Link
https://www.malware-traffic-analysis.net/2020/07/14/index.html
Cape
Cape
https://www.capesandbox.com/analysis/25914/

Comments