MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c26e8e9bce270e1381ed8968384dd63feba64da2f8694c8e0be152ac1aae96a0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

IcedID

Vendor detections: 16

Intelligence 16 IOCs YARA 8 File information Comments

SHA256 hash:	c26e8e9bce270e1381ed8968384dd63feba64da2f8694c8e0be152ac1aae96a0
SHA3-384 hash:	52b677ab66df26bc9c0db06b5eb7e4edfc529be20f03ac2b7996809b7296fc00ddbd2af2dadcc9cd2a3bc79c5ed462f9
SHA1 hash:	8c43dfb6d304d837ee99863499baa7d1d641ef64
MD5 hash:	bd005599bdb917da0b7358b3d6146bcb
humanhash:	fourteen-bakerloo-washington-music
File name:	c26e8e9bce270e1381ed8968384dd63feba64da2f8694c8e0be152ac1aae96a0
Download:	download sample
Signature	IcedID Create hunting rule
File size:	10'752 bytes
First seen:	2024-10-19 11:15:44 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	5a8049d632f4eb2fc4735faed7b61978 (3 x IcedID)
ssdeep	192:5piF7hWH0iI8jKWE2uNB+PEwtDtf7LgzOnDpfSbxNPDt:KNh8q8joRmPEi1LgSnDsbxNP
TLSH	T1A2224CEFAD170BA0EEB690F50276D417E9BA61110DAF8853FB1166C15C315103D6EF63
TrID	56.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 11.8% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 9.0% (.EXE) Win16 NE executable (generic) (5038/12/1) 8.1% (.EXE) Win32 Executable (generic) (4504/4/1) 3.7% (.ICL) Windows Icons Library (generic) (2059/9)
Magika	pebin
Reporter	JAMESWT_WT
Tags:	exe IcedID photoloader wloppyload-top

Intelligence

File Origin

# of uploads :

# of downloads :

802

Origin country :

Vendor Threat Intelligence

Malware family:

icedid

ID:

File name:

c26e8e9bce270e1381ed8968384dd63feba64da2f8694c8e0be152ac1aae96a0

Verdict:

Malicious activity

Analysis date:

2024-10-19 11:17:03 UTC

Tags:

icedid

Link:

https://app.any.run/tasks/3f7eec2a-e309-42b6-b6da-50e30018168f

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection(s):

Win.Downloader.Icedid-9754950-0

Verdict:

Malicious

Score:

99.1%

Link:

https://cyber-fortress.com/docs/result/index.php?id=671394f334f884d15c8d129d

Tags:

Phishing Icedid

Result

Verdict:

Malware

Maliciousness:

Behaviour

Searching for the window

DNS request

Connection attempt

Sending a custom TCP request

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

anti-vm icedid microsoft_visual_cc razy

Link:

https://www.filescan.io/uploads/671394f36dc68a3bc12aef51/reports/4402af0a-f028-4a79-a9ae-c81cc8a285ab/overview

Verdict:

Malicious

Labled as:

Win/malicious_confidence_100%

Link:

https://www.hybrid-analysis.com/sample/c26e8e9bce270e1381ed8968384dd63feba64da2f8694c8e0be152ac1aae96a0

Malware family:

PhotoLoader

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/90f17654-4b24-4152-8333-4ad8ed95fee9

Result

Threat name:

IcedID

Detection:

malicious

Classification:

troj.evad

Score:

80 / 100

Link:

https://www.joesandbox.com/analysis/1537681

Signature

Antivirus / Scanner detection for submitted sample

Contains functionality to detect hardware virtualization (CPUID execution measurement)

Machine Learning detection for sample

Multi AV Scanner detection for submitted file

Yara detected IcedID

Behaviour

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/c26e8e9bce270e1381ed8968384dd63feba64da2f8694c8e0be152ac1aae96a0

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/c26e8e9bce270e1381ed8968384dd63feba64da2f8694c8e0be152ac1aae96a0/

Threat name:

Win32.Trojan.IcedID

Status:

Malicious

First seen:

2021-08-27 02:02:19 UTC

AV detection:

21 of 24 (87.50%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=yjxi5g6oe4hbhapnrfudqtowh7v2mtnc7buuzdql4fjkygvos2qa._file

Verdict:

malicious

Label(s):

photoloader

Similar samples:

error

IcedID

Result

Malware family:

icedid

Score:

10/10

Tags:

family:icedid discovery loader

Link:

https://tria.ge/reports/241019-nc45bstarb/

Behaviour

System Location Discovery: System Language Discovery

Verdict:

Malicious

Tags:

loader icedid

YARA:

Icedid_Unpacked_in_Memory IcedIDLoader IcedID_init_loader icedid_unpacked icedid_2stager

Link:

https://app.threat.zone/submission/a127bb54-eaa9-485c-bb2c-c705a44bea3b

Unpacked files

SH256 hash:

c26e8e9bce270e1381ed8968384dd63feba64da2f8694c8e0be152ac1aae96a0

MD5 hash:

bd005599bdb917da0b7358b3d6146bcb

SHA1 hash:

8c43dfb6d304d837ee99863499baa7d1d641ef64

Detections:

win_photoloader_auto

win_photoloader_a0

IcedID_init_loader

Link:

https://www.unpac.me/results/64bc5215-9b4a-4722-a6a4-e9908825ef44/

Parent samples :

b9ce680718abab18162d7358dd9717276d4d77674f699aac9f7dfc3dc2e9115b
c7441ea5c8a42ce0a3afa24991c8a7f328434d2eba9c3d2a2fc26543c9288f9a
c26e8e9bce270e1381ed8968384dd63feba64da2f8694c8e0be152ac1aae96a0

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.22

Link:

https://yomi.yoroi.company/submissions/c26e8e9bce270e1381ed8968384dd63feba64da2f8694c8e0be152ac1aae96a0

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	crime_win32_icedid_stage1 Create hunting rule
Author:	Rony (@r0ny_123)
Description:	Detects IcedID photoloader
Reference:	https://sysopfb.github.io/malware,/icedid/2020/04/28/IcedIDs-updated-photoloader.html

Rule name:	IcedIDLoader Create hunting rule
Author:	kevoreilly, threathive, enzo, r0ny123
Description:	IcedID Loader

Rule name:	IcedIDStage1 Create hunting rule
Author:	kevoreilly, threathive, enzo
Description:	IcedID Payload

Rule name:	icedid_2stager Create hunting rule
Author:	0x0d4y
Description:	This rule detects samples from the IcedID family unpacked in memory, identifying code reuse of key functions.
Reference:	https://0x0d4y.blog/icedid-technical-analysis/

Rule name:	IcedID_init_loader Create hunting rule
Author:	@bartblaze
Description:	Identifies IcedID (stage 1 and 2, initial loaders).

Rule name:	icedid_unpacked Create hunting rule
Author:	0x0d4y
Description:	This rule detects samples from the IcedID family unpacked in memory, identifying code reuse of key functions.
Reference:	https://0x0d4y.blog/icedid-technical-analysis/

Rule name:	Icedid_Unpacked_in_Memory Create hunting rule
Author:	0x0d4y
Description:	This rule detects samples from the IcedID family unpacked in memory, identifying code reuse of key functions.
Reference:	https://0x0d4y.blog/icedid-technical-analysis/

Rule name:	win_photoloader_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	Detects win.photoloader.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

No further information available

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings

ID	Title	Severity
CHECK_AUTHENTICODE	Missing Authenticode	high
CHECK_DLL_CHARACTERISTICS	Missing dll Security Characteristics (HIGH_ENTROPY_VA)	high
CHECK_NX	Missing Non-Executable Memory Protection	critical

Reviews

ID	Capabilities	Evidence
WIN32_PROCESS_API	Can Create Process and Threads	KERNEL32.dll::CloseHandle WINHTTP.dll::WinHttpCloseHandle
WIN_BASE_API	Uses Win Base API	KERNEL32.dll::LoadLibraryA KERNEL32.dll::GetCommandLineA
WIN_BASE_IO_API	Can Create Files	KERNEL32.dll::CreateFileA KERNEL32.dll::GetTempPathA
WIN_BASE_USER_API	Retrieves Account Information	ADVAPI32.dll::GetUserNameA ADVAPI32.dll::LookupAccountNameW
WIN_HTTP_API	Uses HTTP services	WINHTTP.dll::WinHttpAddRequestHeaders WINHTTP.dll::WinHttpConnect WINHTTP.dll::WinHttpOpen WINHTTP.dll::WinHttpOpenRequest WINHTTP.dll::WinHttpQueryDataAvailable WINHTTP.dll::WinHttpQueryHeaders

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample