MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d0e1699bf9ee9e7eaf123df5fac98aeed2d3e104f939bf5e74c61ad18b79a940. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

IcedID

Vendor detections: 9

Intelligence 9 IOCs YARA 4 File information Comments 1

SHA256 hash:	d0e1699bf9ee9e7eaf123df5fac98aeed2d3e104f939bf5e74c61ad18b79a940
SHA3-384 hash:	98365750566dff4968c97f6c3031ecd6ecb4bf366c56b3ddfd20e3df07bf694c2aa4cfda39f368d04750981e4f6e08a6
SHA1 hash:	7cc05e2ef77e2ae26c80202a039aac1d78a3e4a1
MD5 hash:	844922394b66b46bda4d4be6d352fc84
humanhash:	don-carpet-sierra-illinois
File name:	844922394b66b46bda4d4be6d352fc84.dll
Download:	download sample
Signature	IcedID Create hunting rule
File size:	47'470 bytes
First seen:	2021-05-05 13:22:11 UTC
Last seen:	2021-05-05 13:27:50 UTC
File type:	exe
MIME type:	application/x-dosexec
ssdeep	768:RHppffnqCuZgKEq2OqmBhw9+eyA/Dj74zZ/mgxH7Wgagg1nXFJBMq/umJUZp:NDqvHEbsBneyAbniZPWznfBL/nM
Threatray	1'738 similar samples on MalwareBazaar
TLSH	2F235DCA05700B22D5365672C5B31B28C27BFB40B7D368FBD19C7698C5C2180D772DAA
Reporter	abuse_ch
Tags:	dll IcedID

Intelligence

File Origin

# of uploads :

# of downloads :

128

Origin country :

n/a

Vendor Threat Intelligence

Detection:

IcedIDStage1

Link:

https://www.capesandbox.com/analysis/150626/

Detection(s):

Win.Ransomware.Mountlocker-9851295-0

SecuriteInfo.com.Variant.Ulise.194575.13028.17214.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Sending a UDP request

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

IcedID

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/de08d9e0-ad9f-4254-8576-d3b8fe2cf67c

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/d0e1699bf9ee9e7eaf123df5fac98aeed2d3e104f939bf5e74c61ad18b79a940/

Threat name:

Win64.Trojan.Icedidcrypt

Status:

Malicious

First seen:

2021-05-05 13:23:05 UTC

AV detection:

24 of 29 (82.76%)

Threat level:

5/5

Verdict:

malicious

Label(s):

icedid

Result

Malware family:

icedid

Score:

10/10

Tags:

family:icedid banker loader trojan

Link:

https://tria.ge/reports/210505-n7bpn65892/

Behaviour

Suspicious behavior: EnumeratesProcesses

IcedID First Stage Loader

IcedID, BokBot

Malware Config

C2 Extraction:

usaaforced.fun

Unpacked files

SH256 hash:

d0e1699bf9ee9e7eaf123df5fac98aeed2d3e104f939bf5e74c61ad18b79a940

MD5 hash:

844922394b66b46bda4d4be6d352fc84

SHA1 hash:

7cc05e2ef77e2ae26c80202a039aac1d78a3e4a1

Link:

https://www.unpac.me/results/588c90ec-1302-4385-b5d1-72600fadbecb/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

IcedID

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/d0e1699bf9ee9e7eaf123df5fac98aeed2d3e104f939bf5e74c61ad18b79a940

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	crime_win32_icedid_stage1 Create hunting rule
Author:	Rony (@r0ny_123)
Description:	Detects IcedID Photoloader
Reference:	https://sysopfb.github.io/malware,/icedid/2020/04/28/IcedIDs-updated-photoloader.html

Rule name:	IcedID Create hunting rule
Author:	@bartblaze
Description:	Identifies IcedID (stage 1 and 2, loaders).

Rule name:	IcedIDStage1 Create hunting rule
Author:	kevoreilly, threathive, enzo
Description:	IcedID Payload

Rule name:	MALWARE_Win_IceID Create hunting rule
Author:	ditekSHen
Description:	Detects IceID / Bokbot variants

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

IcedID

exe d0e1699bf9ee9e7eaf123df5fac98aeed2d3e104f939bf5e74c61ad18b79a940

(this sample)

URLhaus

https://urlhaus.abuse.ch/url/1098496/

Delivery method

Distributed via web download

Cape

https://www.capesandbox.com/analysis/150626/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

a̵c̵c̸i̵d̷e̵n̷t̴a̷l̴r̵e̷b̸e̴l̸ commented on 2021-05-05 14:49:35 UTC

============================================================
MBC behaviors list (github.com/accidentalrebel/mbcscan):
============================================================
0) [B0012.001] Anti-Static Analysis::Argument Obfuscation
1) [C0027.009] Cryptography Micro-objective::RC4::Encrypt Data
2) [C0021.004] Cryptography Micro-objective::RC4 PRGA::Generate Pseudo-random Sequence
3) [C0026.002] Data Micro-objective::XOR::Encode Data