MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 befeb1ab986fae9a54d4761d072bf50fdbff5c6b1b89b66a6790a3f0bfc4243f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


IcedID


Vendor detections: 6


Intelligence 6 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: befeb1ab986fae9a54d4761d072bf50fdbff5c6b1b89b66a6790a3f0bfc4243f
SHA3-384 hash: 79830b47572f366ece36e2a975958f60d781c71ba8fe57c38e784203199ce0bebe115c121d2f33c8f9bbf9bad7d58ef0
SHA1 hash: b0bf8c2ed7ae2e6ecb5eb2275015343a712ab8b3
MD5 hash: 1821abde4a17d5c775e197217ca2a1d6
humanhash: network-eleven-high-shade
File name:loader_p1_dll_64_n1_x64_inf.dll53.dll
Download: download sample
Signature IcedID
Create hunting rule
File size:862'208 bytes
First seen:2023-03-10 17:41:59 UTC
Last seen:2023-03-10 19:28:08 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 5849a69ac5db0d393806123381e61a85 (1 x IcedID)
ssdeep 24576:iX/wM8bxdVOcVYXNg31qU1c8/UxMzFni:i9EKNI8U68/U+zFn
TLSH T1BB05F727250021D8F9736038959FF245F9A7B4A0736C7AC78D3404592FA9BFA693E34B
TrID 48.7% (.EXE) Win64 Executable (generic) (10523/12/4)
23.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
9.3% (.EXE) OS/2 Executable (generic) (2029/13)
9.2% (.EXE) Generic Win/DOS Executable (2002/3)
9.2% (.EXE) DOS Executable Generic (2000/1)
Reporter k3dg3___
Tags:3278418257 ariopolanetyoa.com exe IcedID

Intelligence

File Origin
# of uploads :
2
# of downloads :
312
Origin country :
US US
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
loader_p1_dll_64_n1_x64_inf.dll53.dll
Verdict:
No threats detected
Analysis date:
2023-03-10 17:42:41 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/366feb16-70f7-4261-8092-295e1364feee

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/373443/
Detection(s):
SecuriteInfo.com.TrojanSpy.Win64.ICEDID.SMYXDAVZ.17668.21591.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:
Verdict:
No Threat
Threat level:
  2/10
Confidence:
100%
Link:
https://www.filescan.io/uploads/640b6bec578f63046fe2af18/reports/4fe18c7a-f252-4c67-bd01-a9848cd75f5f/overview
Verdict:
Malicious
Labled as:
TrojanS.3F7291CD
Link:
https://www.hybrid-analysis.com/sample/befeb1ab986fae9a54d4761d072bf50fdbff5c6b1b89b66a6790a3f0bfc4243f
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/bfeb9625-9f60-4a07-a439-8940af27cd7c
Result
Threat name:
Unknown
Detection:
clean
Classification:
n/a
Score:
5 / 100
Link:
https://www.joesandbox.com/analysis/1191427
Behaviour
Behavior Graph:
n/a
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/befeb1ab986fae9a54d4761d072bf50fdbff5c6b1b89b66a6790a3f0bfc4243f/
Threat name:
Win64.Trojan.IcedID
Create hunting rule
Status:
Suspicious
First seen:
2023-03-10 17:46:37 UTC
File Type:
PE+ (Dll)
Extracted files:
1
AV detection:
11 of 39 (28.21%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=x37ldk4yn6xjuvguoyoqok7vb7n76xdldoe3m2thscr7bp6eeq7q._file
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/230310-v91lqsge5z/
Behaviour
Suspicious use of WriteProcessMemory
Program crash
Unpacked files
SH256 hash:
befeb1ab986fae9a54d4761d072bf50fdbff5c6b1b89b66a6790a3f0bfc4243f
MD5 hash:
1821abde4a17d5c775e197217ca2a1d6
SHA1 hash:
b0bf8c2ed7ae2e6ecb5eb2275015343a712ab8b3
Link:
https://www.unpac.me/results/9c50971f-fb8e-4ce4-ac4a-845b1a0bcc6c/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/befeb1ab986fae9a54d4761d072bf50fdbff5c6b1b89b66a6790a3f0bfc4243f

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pdb_YARAify
Create hunting rule
Author:@wowabiy314
Description:PDB
Rule name:SPLCrypt
Create hunting rule
Author:James Quinn, Binary Defense
Description:Identifies SPLCrypt, a new crypter associated with Bazaloader

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

IcedID

Executable exe befeb1ab986fae9a54d4761d072bf50fdbff5c6b1b89b66a6790a3f0bfc4243f

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/373443/
  
URLhaus
https://urlhaus.abuse.ch/url/2566103/

Comments