MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c340ae2dde2bd8fbae46b15abef0c7e706fe8953c837329bde409959836d6510. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry



IcedID


Vendor detections: 13


Intelligence 13 IOCs YARA File information Comments

SHA256 hash: c340ae2dde2bd8fbae46b15abef0c7e706fe8953c837329bde409959836d6510
SHA3-384 hash: a13cca16480fb2b4ff59c7034a03222233abf4f8754591453bbfb1d5710b800bfae162b19f525c376c637ba69070a48e
SHA1 hash: fe27de2819b394e2b0824dd28531a4ab914aa855
MD5 hash: 8afee9d09b791bffd2372931cc9060ba
humanhash: summer-july-lactose-sierra
File name:Giowcosi64.dll
Download: download sample
Signature IcedID
File size:116'224 bytes
First seen:2021-12-02 03:17:43 UTC
Last seen:2021-12-02 04:37:56 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f1a15344df95e4a35a13d3ab15c783e1 (1 x IcedID)
ssdeep 1536:CzxBuW7NfJpGgiNrmcefpeuJDVrMOx4NQGroPYqWhO8sWKKhplKtBbM8izw8pCt2:eBnxfJgP4FfMCDVrYycoPj3QMUvvT
Threatray 13 similar samples on MalwareBazaar
TLSH T183B3F73FEEE7E1CCD61910F1DB36D2679C36F52CE43696139B4A07C8A544E1288BE1A4
Reporter @malware_traffic
Tags:BokBot dll exe IcedID

Intelligence


File Origin
# of uploads :
2
# of downloads :
236
Origin country :
US US
Mail intelligence
No data
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Giowcosi64.dll
Verdict:
No threats detected
Analysis date:
2021-12-02 03:20:23 UTC
Tags:
n/a

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Result
Verdict:
Clean
Maliciousness:

Behaviour
DNS request
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Detection:
malicious
Classification:
troj
Score:
68 / 100
Signature
C2 URLs / IPs found in malware configuration
Found malware configuration
Multi AV Scanner detection for submitted file
Yara detected IcedID
Behaviour
Behavior Graph:
behaviorgraph top1 signatures2 2 Behavior Graph ID: 532354 Sample: Giowcosi64.dll Startdate: 02/12/2021 Architecture: WINDOWS Score: 68 19 Found malware configuration 2->19 21 Multi AV Scanner detection for submitted file 2->21 23 Yara detected IcedID 2->23 25 C2 URLs / IPs found in malware configuration 2->25 7 loaddll64.exe 1 2->7         started        process3 process4 9 cmd.exe 1 7->9         started        11 rundll32.exe 7->11         started        13 rundll32.exe 7->13         started        15 4 other processes 7->15 process5 17 rundll32.exe 9->17         started       
Threat name:
Win64.Trojan.IcedID
Status:
Malicious
First seen:
2021-12-02 03:18:09 UTC
File Type:
PE+ (Dll)
AV detection:
21 of 27 (77.78%)
Threat level:
  5/5
Result
Malware family:
Score:
  10/10
Tags:
family:icedid botnet:1892568649 banker trojan
Behaviour
IcedID, BokBot
Malware Config
C2 Extraction:
baeswea.com
bersaww.com
Unpacked files
SH256 hash:
c340ae2dde2bd8fbae46b15abef0c7e706fe8953c837329bde409959836d6510
MD5 hash:
8afee9d09b791bffd2372931cc9060ba
SHA1 hash:
fe27de2819b394e2b0824dd28531a4ab914aa855

File information


The table below shows additional information about this malware sample such as delivery method and external references.

Comments