🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e02e77a8998c380d3b47d6a2e507749b85c420e69b47fdcecc312a5d9ddb667e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


IcedID


Vendor detections: 4


Intelligence 4 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e02e77a8998c380d3b47d6a2e507749b85c420e69b47fdcecc312a5d9ddb667e
SHA3-384 hash: cdef2b284f5ad6e7b4025aafc7eb5b192696800807e9f22f29fb5c4bbe7bf93e019b36d100001e6e9313e0e4eef03f83
SHA1 hash: 78739d01b931bfe8339ae8ffa3acb5b95f52fb4e
MD5 hash: bf5501aa88f1e1ce1077dbd2a7eb388c
humanhash: delaware-angel-item-steak
File name:document-94070.iso
Download: download sample
Signature IcedID
Create hunting rule
File size:602'112 bytes
First seen:2022-11-10 13:35:39 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 12288:FY8gIDGY18uveJ7YpbcbA4k7pvLCmii4:FYtIDGU8uvE7YCbdSFOI4
TLSH T1E5D4ACD6E6B38E69C26572F36A4753A361E3577D909EF740309CA28307C24AC2C75B4E
TrID 99.4% (.NULL) null bytes (2048000/1)
0.2% (.ISO) ISO 9660 CD image (5100/59/2)
0.2% (.ATN) Photoshop Action (5007/6/1)
0.0% (.BIN/MACBIN) MacBinary 1 (1033/5)
0.0% (.ABR) Adobe PhotoShop Brush (1002/3)
Reporter Anonymous
Tags:IcedID iso

Intelligence

File Origin
# of uploads :
1
# of downloads :
174
Origin country :
n/a
File Archive Information

This file archive contains 4 file(s), sorted by their relevance:

File name:consider_went.png
File size:84'480 bytes
SHA256 hash: b3d16a8ecb9b7869d595279155c6c7a791b3091ea357df97c67778a134984449
MD5 hash: ef772fad51a3bf193819b28b24ff9ded
MIME type:application/x-dosexec
Signature IcedID
File name:their_follow.png
File size:138'289 bytes
SHA256 hash: c6294ebb7d2540ee7064c60d361afb54f637370287983c7e5e1e46115613169a
MD5 hash: 49524219dbd2418e3afb4e49e5f1805e
MIME type:image/png
Signature IcedID
File name:egg.cmd
File size:706 bytes
SHA256 hash: 440553916d27a08f2b9c94851249507bff954f36def133d35cd1b97df25448a4
MD5 hash: ac14269735447334594ebd75917cc589
MIME type:text/plain
Signature IcedID
File name:FILES.lnk
File size:2'808 bytes
SHA256 hash: 731b8a98e3c34cad0b327718ba54bd40d44b1dd0b2f8f93bae2c6c5c6c6aee8e
MD5 hash: a8955f2d1abee8d8e25d2a0c828444d4
MIME type:application/octet-stream
Signature IcedID
Vendor Threat Intelligence
Detection(s):
TwinWave.EvilLNK.Guinnesses.20221019.UNOFFICIAL
Create hunting rule

TwinWave.EvilISO.WLLIAMThatPower.20221005.UNOFFICIAL
Create hunting rule

Verdict:
No Threat
Threat level:
  2/10
Confidence:
100%
Tags:
masquerade
Link:
https://www.filescan.io/uploads/636cfe4420a0b4943a8ebc92/reports/4bda92e3-a804-43f3-a400-4b7323d1c1cd/overview
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e02e77a8998c380d3b47d6a2e507749b85c420e69b47fdcecc312a5d9ddb667e/
Threat name:
Shortcut.Trojan.Casdet
Create hunting rule
Status:
Malicious
First seen:
2022-11-10 13:36:08 UTC
File Type:
Binary (Archive)
Extracted files:
4
AV detection:
10 of 39 (25.64%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=4axhpkezrq4a2o2h22rokb3utoc4iihgtnd73twmgevf3ho3mz7a._file
Result
Malware family:
n/a
Score:
  8/10
Tags:
n/a
Link:
https://tria.ge/reports/221110-rdt8asadd9/
Behaviour
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Checks computer location settings
Loads dropped DLL
Executes dropped EXE
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/e02e77a8998c380d3b47d6a2e507749b85c420e69b47fdcecc312a5d9ddb667e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:BitcoinAddress
Create hunting rule
Author:Didier Stevens (@DidierStevens)
Description:Contains a valid Bitcoin address
Rule name:iso_lnk
Create hunting rule
Author:tdawg
Rule name:SPLCrypt
Create hunting rule
Author:James Quinn, Binary Defense
Description:Identifies SPLCrypt, a new crypter associated with Bazaloader
Rule name:SUSP_EXE_in_ISO
Create hunting rule
Author:SECUINFRA Falcon Team
Description:Detects ISO files that contains an Exe file. Does not need to be malicious
Reference:Internal Research

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments