MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cc32026b3e9ae6f3c93d8ec1ceb185eabf66be9981752b0623511d2fc1c93501. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

IcedID

Vendor detections: 6

Intelligence 6 IOCs YARA 1 File information Comments

SHA256 hash:	cc32026b3e9ae6f3c93d8ec1ceb185eabf66be9981752b0623511d2fc1c93501
SHA3-384 hash:	8a8371323ddaf69a7f77a692b63826572cc169433e69c8d9b23b9537755d6c2d14e116e5c5f00c1b5d5feb1c7240d06e
SHA1 hash:	b704fe0eb662dbbdd43e7a075f08de860219c98b
MD5 hash:	5ab7f2f81c7ebb143f5e3dd1949ef7f9
humanhash:	chicken-papa-coffee-london
File name:	h1imal.dll
Download:	download sample
Signature	IcedID Create hunting rule
File size:	218'112 bytes
First seen:	2022-07-26 23:47:02 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
ssdeep	3072:ex7Ooa5ttrdjvLz3m5BOa9VnvRev0SBLyMLDPt+d80UJGmJQIo0BT0nt/jXj3/tc:C7OF5LdrLz3Azv4r0JmNx
Threatray	555 similar samples on MalwareBazaar
TLSH	T1E72449629486009AE53281B5C531BD4C7A2A6C37DF05CF99FEBC1BEBDBC1E419A31706
TrID	63.5% (.EXE) Win64 Executable (generic) (10523/12/4) 12.2% (.EXE) OS/2 Executable (generic) (2029/13) 12.0% (.EXE) Generic Win/DOS Executable (2002/3) 12.0% (.EXE) DOS Executable Generic (2000/1)
Reporter	pr0xylife
Tags:	exe IcedID

Intelligence

File Origin

# of uploads :

# of downloads :

327

Origin country :

n/a

Vendor Threat Intelligence

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/294475/

Detection(s):

SecuriteInfo.com.UDS.Trojan-Banker.Win32.IcedID.uecy.895.2951.UNOFFICIAL

Result

Verdict:

Clean

Maliciousness:

Behaviour

Searching for the window

Result

Verdict:

UNKNOWN

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Verdict:

Suspicious

Link:

https://analyze.intezer.com/analyses/37cbb99f-1530-41b3-a8ee-9486f0575e94

Result

Threat name:

IcedID

Detection:

malicious

Classification:

troj.evad

Score:

92 / 100

Link:

https://www.joesandbox.com/analysis/1041506

Signature

C2 URLs / IPs found in malware configuration

Contains functionality to detect hardware virtualization (CPUID execution measurement)

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

System process connects to network (likely due to code injection or exploit)

Tries to detect virtualization through RDTSC time measurements

Yara detected IcedID

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/cc32026b3e9ae6f3c93d8ec1ceb185eabf66be9981752b0623511d2fc1c93501/

Threat name:

Win64.Trojan.IcedID

Status:

Malicious

First seen:

2022-07-26 23:48:08 UTC

File Type:

PE+ (Dll)

Extracted files:

AV detection:

16 of 40 (40.00%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=zqzae2z6tltphsj5r3a45mmf5k7wnpuzqf2swbrdkeos7qojguaq._file

Verdict:

malicious

Label(s):

icedid

IcedID

4b312a119321503383fbf9aaf65659046656096a7551d5a581f5cbb0055493c3

IcedID

670790c8b4649865ef391bac63417c00ffbaa203c5df36d6c9720832b0949dcb

IcedID

88106951a7b882df60bdfc84cb5c568a005cd894138024dc3bbbad904e185898

IcedID

8947a3dd22f3dce991cde0fd5793f3b754cf4530c2d6ae61791060645b72e4c4

IcedID

d6e7162c6a0a8f6063c52a3346fdca5c8e2822e479a5b6e644a716b92bc653d5

IcedID

dd0f3f7c40ccc4f8fbe921e8b7db1f9d35a75a686e4ed7b06af52a791364a899

IcedID

fd0e07ec492cb76abaca206083a13f5cad0a3ed563495c852f13b4876e63974c

IcedID

+ 545 additional samples on MalwareBazaar

Result

Malware family:

n/a

Score:

1/10

Tags:

n/a

Link:

https://tria.ge/reports/220726-3swv8afdfq/

Unpacked files

SH256 hash:

cc32026b3e9ae6f3c93d8ec1ceb185eabf66be9981752b0623511d2fc1c93501

MD5 hash:

5ab7f2f81c7ebb143f5e3dd1949ef7f9

SHA1 hash:

b704fe0eb662dbbdd43e7a075f08de860219c98b

Link:

https://www.unpac.me/results/b5d6e206-757f-4155-9b03-03479e0edeeb/

Malware family:

IcedID

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/cc32026b3e9a/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.