MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cc369572ffe3f4f3bdfc044aa0f1226b230ef4f0620d1bb3b079f88ef9561ad3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

IcedID

Vendor detections: 7

Intelligence 7 IOCs 1 YARA 1 File information Comments

SHA256 hash:	cc369572ffe3f4f3bdfc044aa0f1226b230ef4f0620d1bb3b079f88ef9561ad3
SHA3-384 hash:	79c25e4d57e9878a1e0a72177769fe83f9642c90f4c53ba0117451ce26c2161ee5a04408f21a7cf74a62697478fcee6d
SHA1 hash:	c9d32e0c2adacfc1f256df96d171d5a13df05a30
MD5 hash:	4b317fe2f63b0c3e317790f2491367d6
humanhash:	apart-blossom-video-tango
File name:	4b317fe2f63b0c3e317790f2491367d6.dll
Download:	download sample
Signature	IcedID Create hunting rule
File size:	44'192 bytes
First seen:	2021-03-30 16:31:21 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
ssdeep	768:RHppffnqCuZgKEq2OqmBhw9+eyA/Dj74zZ/mgxH7Wgagg1nXFJBMq/umJUZp:NDqvHEbsBneyAbniZPWznfBL/nM
Threatray	265 similar samples on MalwareBazaar
TLSH	DF135DCA05700B22D5365672C5B31B28C27BFB40B7D368FBD19C7698C5C2180D772DAA
Reporter	abuse_ch
Tags:	dll IcedID

abuse_ch

IcedID C2:
usaaforced.fun

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOC	ThreatFox Reference
usaaforced.fun	https://threatfox.abuse.ch/ioc/6146/

Intelligence

File Origin

# of uploads :

# of downloads :

122

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

4b317fe2f63b0c3e317790f2491367d6.dll

Verdict:

No threats detected

Analysis date:

2021-03-31 01:43:18 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/26913c01-f7ca-4834-87b4-bbfbda527319

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

BazaLoader

Link:

https://www.capesandbox.com/analysis/128406/

Detection(s):

SecuriteInfo.com.Variant.Ulise.194575.13028.17214.UNOFFICIAL

Result

Verdict:

Clean

Maliciousness:

Behaviour

Deleting a recently created file

Creating a file in the Windows subdirectories

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/cc369572ffe3f4f3bdfc044aa0f1226b230ef4f0620d1bb3b079f88ef9561ad3/

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=zq3jk4x74p2phpp4arfkb4jcnmrq55hqmigrxm5qph4i56kwdljq._file

Verdict:

malicious

Label(s):

icedid

Result

Malware family:

icedid

Score:

10/10

Tags:

family:icedid banker loader trojan

Link:

https://tria.ge/reports/210330-7kr6jgjar2/

Behaviour

Suspicious behavior: EnumeratesProcesses

IcedID First Stage Loader

IcedID, BokBot

Malware Config

C2 Extraction:

usaaforced.fun

Unpacked files

SH256 hash:

cc369572ffe3f4f3bdfc044aa0f1226b230ef4f0620d1bb3b079f88ef9561ad3

MD5 hash:

4b317fe2f63b0c3e317790f2491367d6

SHA1 hash:

c9d32e0c2adacfc1f256df96d171d5a13df05a30

Link:

https://www.unpac.me/results/43561926-d56b-4b62-bb8b-2b1f2f8262d0/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

0.76

Link:

https://yomi.yoroi.company/submissions/cc369572ffe3f4f3bdfc044aa0f1226b230ef4f0620d1bb3b079f88ef9561ad3

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	crime_win32_icedid_stage1 Create hunting rule
Author:	Rony (@r0ny_123)
Description:	Detects IcedID Photoloader
Reference:	https://sysopfb.github.io/malware,/icedid/2020/04/28/IcedIDs-updated-photoloader.html