MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e15f166220a800acfdf7a8df1c7a1bf441d4326347905a2e595ea988f0bd6c91. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

IcedID

Vendor detections: 7

Intelligence 7 IOCs YARA 1 File information Comments

SHA256 hash:	e15f166220a800acfdf7a8df1c7a1bf441d4326347905a2e595ea988f0bd6c91
SHA3-384 hash:	9406a2ed257ca91c1c75d3569c1331eb5778eb37d7daa21b9f425580458aad816865c5bc2591a807b0457e880d9c7d4a
SHA1 hash:	02deffcc2b930d5c49a6d26e4e713f210248e1de
MD5 hash:	fdc1bdf5fd4fcacf23ecf24ee507e03e
humanhash:	video-white-island-music
File name:	b.dll
Download:	download sample
Signature	IcedID Create hunting rule
File size:	176'024 bytes
First seen:	2022-08-03 07:29:37 UTC
Last seen:	2022-08-03 10:09:17 UTC
File type:	exe
MIME type:	application/x-dosexec
ssdeep	3072:+LUDvzipNOnSwH3FWur1LOj1nB3SWmRbOOLOVk6ISFKC/Ukw:JDziix1WuJL+WCiODRF+kw
Threatray	576 similar samples on MalwareBazaar
TLSH	T1DD044A5DF3013856C1AB927400673A0B62336A19AB49C88CB53C9FEA1B7ED54727BF74
TrID	63.5% (.EXE) Win64 Executable (generic) (10523/12/4) 12.2% (.EXE) OS/2 Executable (generic) (2029/13) 12.0% (.EXE) Generic Win/DOS Executable (2002/3) 12.0% (.EXE) DOS Executable Generic (2000/1)
Reporter	JAMESWT_WT
Tags:	exe FORWARD MUSIC AGENCY SRL IcedID signed

Code Signing Certificate

Organisation:	FORWARD MUSIC AGENCY SRL
Issuer:	Sectigo Public Code Signing CA R36
Algorithm:	sha384WithRSAEncryption
Valid from:	2022-07-14T00:00:00Z
Valid to:	2023-07-14T23:59:59Z
Serial number:	df2547b2cab5689a81d61de80eaaa3a2
Intelligence:	3 malware samples on MalwareBazaar are signed with this code signing certificate
MalwareBazaar Blocklist:	This certificate is on the MalwareBazaar code signing certificate blocklist (CSCB)
Thumbprint Algorithm:	SHA256
Thumbprint:	4c6e21a6e96ea6fae6c142c2d1c919f590d9bf4e5c6b0f3ec7f9b0a38f3ce45d
Source:	This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin

# of uploads :

# of downloads :

288

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

b.dll

Verdict:

No threats detected

Analysis date:

2022-08-03 08:12:58 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/19f58275-1e95-4c65-b43a-7ad4e04028c3

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/296090/

Detection(s):

SecuriteInfo.com.Trojan.GenericKD.61106351.28573.1888.UNOFFICIAL

Result

Verdict:

Clean

Maliciousness:

Behaviour

Сreating synchronization primitives

Creating a file

Searching for synchronization primitives

Launching a process

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

overlay packed

Link:

https://www.filescan.io/uploads/62ea23ff6336465f2a093bf2/reports/11ea8643-28e8-4c8c-9e54-4325a44d3c23/overview

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Verdict:

Suspicious

Link:

https://analyze.intezer.com/analyses/d179e7f7-af71-49af-93fb-4ec81deb0122

Result

Threat name:

IcedID

Detection:

malicious

Classification:

troj.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1045433

Signature

Antivirus detection for URL or domain

C2 URLs / IPs found in malware configuration

Contains functionality to detect hardware virtualization (CPUID execution measurement)

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

System process connects to network (likely due to code injection or exploit)

Tries to detect virtualization through RDTSC time measurements

Yara detected IcedID

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/e15f166220a800acfdf7a8df1c7a1bf441d4326347905a2e595ea988f0bd6c91/

Threat name:

Win64.Trojan.IcedID

Status:

Suspicious

First seen:

2022-07-30 22:54:40 UTC

File Type:

PE+ (Dll)

Extracted files:

AV detection:

17 of 40 (42.50%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=4fprmyravaakz7pxvdpry6q36ra5imtdi6ifulszl2uyr4f5nsiq._file

Verdict:

malicious

Label(s):

icedid

IcedID

5581797b516ee436276cbf806171a1b3fd009f10f550fefdebba4430cabedcbd

IcedID

7be9d46382e6b03c2d29f85755e10fdc755a91c7d646331214a3717c8259f120

IcedID

a404e5baa4888aa01ee395ba623853774cabcbc63d24c9d6559e960a47daec78

IcedID

cddca7061ac3cc7efa1d25e78f82de4d238038d4ab8c489a05626304a9a6cfb0

IcedID

eab862ecee5838fc497a89431ad921e8351da2f4f90cbcb7752a2e40109975a7

IcedID

f67709a50be5252870c9a5d4447d106080e9334b7fd0016d313add9e989d26ed

IcedID

+ 566 additional samples on MalwareBazaar

Result

Malware family:

n/a

Score:

1/10

Tags:

n/a

Link:

https://tria.ge/reports/220803-jbs88agec6/

Unpacked files

SH256 hash:

e15f166220a800acfdf7a8df1c7a1bf441d4326347905a2e595ea988f0bd6c91

MD5 hash:

fdc1bdf5fd4fcacf23ecf24ee507e03e

SHA1 hash:

02deffcc2b930d5c49a6d26e4e713f210248e1de

Link:

https://www.unpac.me/results/823c0999-3a9a-44cf-9466-fc132df8e4a5/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/e15f166220a800acfdf7a8df1c7a1bf441d4326347905a2e595ea988f0bd6c91

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.