MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ce6e51ab9d45e2555cec4cc21eae79584f23fe843c04313d6a2ffc21e0fddd49. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


IcedID


Vendor detections: 4


Intelligence 4 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ce6e51ab9d45e2555cec4cc21eae79584f23fe843c04313d6a2ffc21e0fddd49
SHA3-384 hash: ced2738bb3eb6309ebe104919b75f452a846bddd94e7c80af2c586c114973fb235e4b4b6c3dbfcf6bad6677d83d4bc3b
SHA1 hash: 91ab7aca64fa38f8eaa5a797696ddc097b35e439
MD5 hash: 354fe767db553a9121e911e70edca2f4
humanhash: double-pip-carpet-bakerloo
File name:kfa2.bin
Download: download sample
Signature IcedID
Create hunting rule
File size:371'712 bytes
First seen:2020-07-24 17:59:36 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash 4e9b9131f4160c5dc4ae908eed15b416 (4 x IcedID)
ssdeep 6144:MdVOmNDo0xxiR2BcDeP0PDcTeZJIUJgLdA:MfDo0DiR2BcqP8DGerz
Threatray 33 similar samples on MalwareBazaar
TLSH AE847D00EA90D039F4FF06B95A7685A9A9387DA0577CC4CF97C125AF1A346E2ED31B13
Reporter malware_traffic
Tags:dll IcedID Shathak TA551

Intelligence

File Origin
# of uploads :
1
# of downloads :
104
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/32262/
Detection(s):
PUA.Win.Packer.PrivateExeProte-11
Create hunting rule

PUA.Win.Downloader.Aiis-6803892-0
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Sending a custom TCP request
Result
Threat name:
IcedID
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
64 / 100
Link:
https://www.joesandbox.com/analysis/397633
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ce6e51ab9d45e2555cec4cc21eae79584f23fe843c04313d6a2ffc21e0fddd49/
Threat name:
Win32.Worm.Cridex
Create hunting rule
Status:
Malicious
First seen:
2020-07-24 18:01:04 UTC
AV detection:
22 of 29 (75.86%)
Threat level:
  5/5
Verdict:
unknown
Similar samples:
08605832a51e9b9b15ed35538064c26dfee05343bb09c62a83ed4b5fe2bfdb72
IcedID
2ab9bf80e3dd6d73b43e711b8941e81a2606ac315ffb771fdb9212033e90520d
IcedID
3bdf5d01989e203e6edb9ee61fd310d79bd4c7163ca4b8aeef66f5ec035bee87
IcedID
4a222b602fba21c1679cdb179bbcc7d1543c7c63d8305cf284f0f57f108c34e1
IcedID
5dad316f13bfad0dc5609d4df8fade8cb4ca358b734c13e6ea4970081038375b
IcedID
6095525df3b44b1a3ed02aace8edfa6adce837e758ea859457f58fcff1d98095
IcedID
6196a0966d3fbe5726736f0fd7661a0a928fdce345cb377e79cea039594a79f0
IcedID
763045778cf8977b3da1f081ce871cf57570cfafa98d9d4c0334e554a0d77ac3
IcedID
ab7765cafe9cab11e9e2d5ff1a1fffa3fdc7fb9cb8c1e35874f56ea9d3432042
IcedID
ffeb14131f5dff40f5b0e82c3b2f246ddb43003fa3282450845d20cb3c36048c
IcedID
+ 23 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
n/a
Link:
https://tria.ge/reports/200724-f2vgswmt3n/
Behaviour
Suspicious use of WriteProcessMemory
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Suspicious behavior: EnumeratesProcesses
Blacklisted process makes network request
Blacklisted process makes network request
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/ce6e51ab9d45e2555cec4cc21eae79584f23fe843c04313d6a2ffc21e0fddd49

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:win_unidentified_023_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/32262/

Comments