🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c41b62c08150340a18b6fc1a3acde0b8496441497b1a2af9b8f3c7ea4d2b573e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


IcedID


Vendor detections: 8


Intelligence 8 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c41b62c08150340a18b6fc1a3acde0b8496441497b1a2af9b8f3c7ea4d2b573e
SHA3-384 hash: 17cebbdbb105f9162c8fa6ec01f3fbea7f92a4f0037496ef4fd6c8aabb98e17a5d4ef9434d6b1d03b94d2acdbaf380b3
SHA1 hash: d6153ceff4f9a5de15da0f34ec2c49253de680fe
MD5 hash: be17076d7ad8c7427d83230266210b0b
humanhash: montana-uniform-nebraska-jersey
File name:iroha.js
Download: download sample
Signature IcedID
Create hunting rule
File size:87'706 bytes
First seen:2023-07-17 20:04:59 UTC
Last seen:2023-07-18 08:37:17 UTC
File type:Java Script (JS) js
MIME type:text/plain
ssdeep 1536:l4olw869MyEo2L3DTemFEkNexpTydJGvw1CRmoEQTvrVgRnNVM+aHoJI0pbf8+vq:lT+86ZF2XTemFEkN+pTydJGo1WEioVaH
TLSH T1518372CB27E2FC420913227033AA76E5E629DD9192C94C9CF018B458F1B991EF9FD59C
Reporter obfusor
Tags:IcedID js

Intelligence

File Origin
# of uploads :
2
# of downloads :
343
Origin country :
HK HK
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.VBS.Obfuscated-gen.5796.4679.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
evasive lolbin obfuscated packed powershell rundll32
Link:
https://www.filescan.io/uploads/64b59ef0a09960069744f738/reports/17fc752e-367f-44d5-8435-325fa55fd5db/overview
Verdict:
Suspicious
Labled as:
Trojan.Script.Heuristic
Link:
https://www.hybrid-analysis.com/sample/c41b62c08150340a18b6fc1a3acde0b8496441497b1a2af9b8f3c7ea4d2b573e
Result
Threat name:
IcedID
Create hunting rule
Detection:
malicious
Classification:
evad.troj
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1274698
Signature
Benign windows process drops PE files
C2 URLs / IPs found in malware configuration
Changes memory attributes in foreign processes to executable or writable
Contains functionality to detect hardware virtualization (CPUID execution measurement)
Found malware configuration
JScript performs obfuscated calls to suspicious functions
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Multi AV Scanner detection for domain / URL
Queues an APC in another process (thread injection)
Sigma detected: Execute DLL with spoofed extension
System process connects to network (likely due to code injection or exploit)
Yara detected IcedID
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1274698 Sample: iroha.js Startdate: 17/07/2023 Architecture: WINDOWS Score: 100 28 wiraofise.com 2->28 30 testserbia.com 2->30 32 officialk2spice.com 2->32 40 Multi AV Scanner detection for domain / URL 2->40 42 Found malware configuration 2->42 44 Malicious sample detected (through community Yara rule) 2->44 46 3 other signatures 2->46 8 wscript.exe 1 19 2->8         started        signatures3 process4 dnsIp5 36 testserbia.com 104.248.165.163, 443, 50243 DIGITALOCEAN-ASNUS United States 8->36 38 officialk2spice.com 68.178.145.103, 443, 50241 AS-26496-GO-DADDY-COM-LLCUS United States 8->38 22 C:\Users\user\AppData\Roaming\...\779088.dat, PE32+ 8->22 dropped 24 C:\Users\user\AppData\Roaming\...\65133.dat, data 8->24 dropped 26 C:\Users\user\AppData\...\03fdbbbb[1].dll, PE32+ 8->26 dropped 50 System process connects to network (likely due to code injection or exploit) 8->50 52 Benign windows process drops PE files 8->52 54 JScript performs obfuscated calls to suspicious functions 8->54 13 rundll32.exe 8->13         started        16 rundll32.exe 8->16         started        file6 signatures7 process8 signatures9 56 Changes memory attributes in foreign processes to executable or writable 13->56 58 Maps a DLL or memory area into another process 13->58 60 Queues an APC in another process (thread injection) 13->60 18 svchost.exe 13->18 injected process10 dnsIp11 34 wiraofise.com 206.189.138.24, 50242, 50244, 50248 DIGITALOCEAN-ASNUS United States 18->34 48 Contains functionality to detect hardware virtualization (CPUID execution measurement) 18->48 signatures12
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c41b62c08150340a18b6fc1a3acde0b8496441497b1a2af9b8f3c7ea4d2b573e/
Threat name:
Script-WScript.Trojan.Heuristic
Create hunting rule
Status:
Malicious
First seen:
2023-07-17 20:05:06 UTC
File Type:
Text (JavaScript)
AV detection:
1 of 38 (2.63%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=yqnwfqebka2augfw7qndvtpaxbewiqkjpmncv6ny6pd6utjlk47a._file
Result
Malware family:
icedid
Create hunting rule
Score:
  10/10
Tags:
family:icedid campaign:2896352683 banker loader trojan
Link:
https://tria.ge/reports/230717-yttd9sef87/
Behaviour
Modifies system certificate store
Suspicious behavior: AddClipboardFormatListener
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
Checks computer location settings
Loads dropped DLL
Blocklisted process makes network request
Downloads MZ/PE file
IcedID, BokBot
Malware Config
C2 Extraction:
wiraofise.com
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/c41b62c08150340a18b6fc1a3acde0b8496441497b1a2af9b8f3c7ea4d2b573e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:SUSP_obfuscated_JS_obfuscatorio
Create hunting rule
Author:@imp0rtp3
Description:Detects JS obfuscation done by the js obfuscator (often malicious)
Reference:https://obfuscator.io

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments