MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d4a69a6a68e105c1757fc667b0a67fa46628dec97f29af4649a958feb1f37b23. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	d4a69a6a68e105c1757fc667b0a67fa46628dec97f29af4649a958feb1f37b23
SHA3-384 hash:	026ea34248559d36a582488f747c7e090b762f0e9ced79190907f90388aac21761284947e88e93487975ab1f7f4aaf86
SHA1 hash:	af9559af3950c6d05282701e9775e90fa1c9e6c9
MD5 hash:	5f4cb4b0da656a03c155c8f66c431826
humanhash:	south-iowa-undress-helium
File name:	Scan_06_23_Payment(123).js
Download:	download sample
Signature	IcedID Alert Create hunting rule
File size:	770'573 bytes
First seen:	2023-06-27 11:56:03 UTC
Last seen:	Never
File type:	js
MIME type:	text/plain
ssdeep	12288:DBeYy4Q74mVTDSpiD0CFSjhGpnXo8SYC7okiiJzjx7KzpCGdGEx1aqNoAOo9itwT:VeYnQEmVTDSpiD0CFSjhonXo8SYC78iO
TLSH	T167F4AAC223EBBD4304575372335426F6D93ACA65C9E994DCF6453D98F0ECE02BA982C6
Reporter	JAMESWT_WT
Tags:	IcedID js

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

380

Origin country :

IT

Vendor Threat Intelligence

FileScan.IO Suspicious

Verdict:

Suspicious

Threat level:

  5/10

Confidence:

100%

Tags:

masquerade

Link:

https://www.filescan.io/uploads/649ace8eb9c57904851e2e33/reports/c76635f4-c4f2-4696-a21b-226e1a864e43/overview

Hybrid Analysis Trojan.Script.Heuristic

Verdict:

Malicious

Labled as:

Trojan.Script.Heuristic

Link:

https://www.hybrid-analysis.com/sample/d4a69a6a68e105c1757fc667b0a67fa46628dec97f29af4649a958feb1f37b23

Joe Sandbox IcedID

Result

Threat name:

IcedID

Alert

Create hunting rule

Detection:

malicious

Classification:

evad.troj

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1262037

Signature

Benign windows process drops PE files

C2 URLs / IPs found in malware configuration

Changes memory attributes in foreign processes to executable or writable

Contains functionality to detect hardware virtualization (CPUID execution measurement)

Found malware configuration

JScript performs obfuscated calls to suspicious functions

Malicious sample detected (through community Yara rule)

Queues an APC in another process (thread injection)

Sigma detected: Execute DLL with spoofed extension

System process connects to network (likely due to code injection or exploit)

Writes to foreign memory regions

Yara detected IcedID

Behaviour

Behavior Graph:

Download SVG

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/d4a69a6a68e105c1757fc667b0a67fa46628dec97f29af4649a958feb1f37b23/

ReversingLabs TitaniumCloud Script-JS.Trojan.IcedID

Threat name:

Script-JS.Trojan.IcedID

Alert

Create hunting rule

Status:

Suspicious

First seen:

2023-06-24 09:33:18 UTC

File Type:

Text (JavaScript)

AV detection:

5 of 24 (20.83%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=2stju2ti4ec4c5l7yzt3bjt7urtcrxwjp4u26rsjvfmp5mptpmrq._file

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  8/10

Tags:

n/a

Link:

https://tria.ge/reports/230627-n323naeh21/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Checks computer location settings

Loads dropped DLL

Blocklisted process makes network request

Downloads MZ/PE file

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI IcedID

Threat name:

IcedID

Score:

0.90

Link:

https://yomi.yoroi.company/submissions/d4a69a6a68e105c1757fc667b0a67fa46628dec97f29af4649a958feb1f37b23