MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c340ae2dde2bd8fbae46b15abef0c7e706fe8953c837329bde409959836d6510. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


IcedID


Vendor detections: 13


Intelligence 13 IOCs YARA File information Comments
Add tag Delete this sample Report a False Positive

SHA256 hash: c340ae2dde2bd8fbae46b15abef0c7e706fe8953c837329bde409959836d6510
SHA3-384 hash: a13cca16480fb2b4ff59c7034a03222233abf4f8754591453bbfb1d5710b800bfae162b19f525c376c637ba69070a48e
SHA1 hash: fe27de2819b394e2b0824dd28531a4ab914aa855
MD5 hash: 8afee9d09b791bffd2372931cc9060ba
humanhash: summer-july-lactose-sierra
File name:Giowcosi64.dll
Download: download sample
Signature IcedID
Create hunting rule
File size:116'224 bytes
First seen:2021-12-02 03:17:43 UTC
Last seen:2021-12-02 04:37:56 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f1a15344df95e4a35a13d3ab15c783e1 (1 x IcedID)
ssdeep 1536:CzxBuW7NfJpGgiNrmcefpeuJDVrMOx4NQGroPYqWhO8sWKKhplKtBbM8izw8pCt2:eBnxfJgP4FfMCDVrYycoPj3QMUvvT
Threatray 13 similar samples on MalwareBazaar
TLSH T183B3F73FEEE7E1CCD61910F1DB36D2679C36F52CE43696139B4A07C8A544E1288BE1A4
Reporter @malware_traffic
Tags:BokBot dll exe IcedID

Intelligence

File Origin
# of uploads :
2
# of downloads :
236
Origin country :
US US
Mail intelligence
No data
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Giowcosi64.dll
Verdict:
No threats detected
Analysis date:
2021-12-02 03:20:23 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/ac23a529-d86c-4bcb-b8f6-b4c63cce8d06

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/210537/
Detection(s):
SecuriteInfo.com.Variant.Lazy.60720.31616.5839.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
DNS request
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/484/overview
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Link:
https://www.filescan.io/uploads/61a83aeef9d950eb11b6310e/reports/efe4be9f-a788-4ad7-9188-76f77c260e58/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
IcedID
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/8a90c65a-f3da-4145-aaa7-488e3da4d80c
Result
Threat name:
IcedID
Create hunting rule
Detection:
malicious
Classification:
troj
Score:
68 / 100
Link:
https://www.joesandbox.com/analysis/899876
Signature
C2 URLs / IPs found in malware configuration
Found malware configuration
Multi AV Scanner detection for submitted file
Yara detected IcedID
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 532354 Sample: Giowcosi64.dll Startdate: 02/12/2021 Architecture: WINDOWS Score: 68 19 Found malware configuration 2->19 21 Multi AV Scanner detection for submitted file 2->21 23 Yara detected IcedID 2->23 25 C2 URLs / IPs found in malware configuration 2->25 7 loaddll64.exe 1 2->7         started        process3 process4 9 cmd.exe 1 7->9         started        11 rundll32.exe 7->11         started        13 rundll32.exe 7->13         started        15 4 other processes 7->15 process5 17 rundll32.exe 9->17         started       
Detection:
icedid
Create hunting rule
Link:
https://mwdb.cert.pl/sample/c340ae2dde2bd8fbae46b15abef0c7e706fe8953c837329bde409959836d6510/
Threat name:
Win64.Trojan.IcedID
Create hunting rule
Status:
Malicious
First seen:
2021-12-02 03:18:09 UTC
File Type:
PE+ (Dll)
AV detection:
21 of 27 (77.78%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://www.spamhaus.org/query/hash/ynak4lo6fpmpxlsgwfnl54gh44dp5cktza3tfg66icmvta3nmuia._file
Verdict:
malicious
Similar samples:
1f136522cc2cdea93e2086aa67ab07102bcef7e31b201489b43707986824b3f8
IcedID
4a3dc99f99af4f2d8bd707a4163886df47cbdf6934856c416785010334412043
IcedID
a102a8d69fbffb877a046f203486657cb522dd53c10a3c93f395a4eb5b6a3dcc
IcedID
aa2cb7c438568cb9baf184532b6bda4677cd3bb9f22f8d3e65e22588eeace26f
IcedID
cd18e2bebc72f731a5dbe0588ab3633b0421f45fa205cbb674f231d56f4a4e5a
IcedID
d4804d424161118b1f6d4d1106b6ed8881be23d8078e2d6f9da84dfdc1c34d92
IcedID
f29dbde41d19fa55ca3cd077df6833441aca6df5f1cfccbca9ed9554214263da
IcedID
fb46649e51c1b2fc47d3bc0a129563c7bcb6f7e5353d46e0a0bd2f1205d675b9
IcedID
fd2f1c48403857b80a466cb30f43a3b49e02cd480ee9cf05f6038d4816e2563b
IcedID
+ 3 additional samples on MalwareBazaar
Result
Malware family:
icedid
Create hunting rule
Score:
  10/10
Tags:
family:icedid botnet:1892568649 banker trojan
Link:
https://tria.ge/reports/211202-dtmaqsdge9/
Behaviour
IcedID, BokBot
Malware Config
C2 Extraction:
baeswea.com
bersaww.com
Unpacked files
SH256 hash:
c340ae2dde2bd8fbae46b15abef0c7e706fe8953c837329bde409959836d6510
MD5 hash:
8afee9d09b791bffd2372931cc9060ba
SHA1 hash:
fe27de2819b394e2b0824dd28531a4ab914aa855
Link:
https://www.unpac.me/results/2b05a49b-0318-4282-9452-40a57ca60371/
AV coverage:
20.00%
AV detections:
13 / 65
Link:
https://www.virustotal.com/gui/file/c340ae2dde2bd8fbae46b15abef0c7e706fe8953c837329bde409959836d6510/detection/f-c340ae2dde2bd8fbae46b15abef0c7e706fe8953c837329bde409959836d6510-1638414911
Threat name:
Malicious File
Score:
0.96
Link:
https://yomi.yoroi.company/submissions/c340ae2dde2bd8fbae46b15abef0c7e706fe8953c837329bde409959836d6510

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/210537/

Comments