MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e22dc7e32dfb8e2f9f75c72dede8b4bbfad86c3e90d03f7b8ffa2d44165afff8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

IcedID

Vendor detections: 7

Intelligence 7 IOCs YARA 1 File information Comments

SHA256 hash:	e22dc7e32dfb8e2f9f75c72dede8b4bbfad86c3e90d03f7b8ffa2d44165afff8
SHA3-384 hash:	caf0e7ca085954df62eb60f0beb6b46400bd7fb26676d1db9eab42bff8c79ffa2012a0c6c57ba3f8f824502f8996a586
SHA1 hash:	c12fceb0c79b26b85ae6fb9134e56a2ddbd6b544
MD5 hash:	f9329056c318c4b1be6931135dc76f9e
humanhash:	nineteen-artist-lactose-grey
File name:	5626.exe
Download:	download sample
Signature	IcedID Create hunting rule
File size:	462'848 bytes
First seen:	2020-07-16 06:54:55 UTC
Last seen:	2020-07-27 10:04:55 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	8b90e196e8cd13cac2efbe414098f9aa (2 x IcedID)
ssdeep	1536:seYG+XbSZ34n0FbLwBypA688uDKmGXqqU095i4KroqLIK5cRKllext6+g:sgeeZoAwAAL8uoXqzwyTlYv
Threatray	431 similar samples on MalwareBazaar
TLSH	F9A46BCCF6956644C43C843845125CB78FE2D97E530DE3A18299BB4A33B9F252AB48DF
Reporter	abuse_ch
Tags:	exe IcedID

abuse_ch

IcedID payload URL:
http://www.haeunkim.com/5626.exe

IcedID C2:
https://ldrmars.casa

Intelligence

File Origin

# of uploads :

# of downloads :

109

Origin country :

n/a

Vendor Threat Intelligence

Detection:

IcedID

Link:

https://www.capesandbox.com/analysis/26404/

Detection(s):

SecuriteInfo.com.Generic.mg.f9329056c318c4b1.25505.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Changing a file

DNS request

Sending a custom TCP request

Result

Threat name:

IcedID

Detection:

malicious

Classification:

troj.evad

Score:

68 / 100

Link:

https://www.joesandbox.com/analysis/389359

Signature

Contains functionality to detect hardware virtualization (CPUID execution measurement)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Yara detected IcedID

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/e22dc7e32dfb8e2f9f75c72dede8b4bbfad86c3e90d03f7b8ffa2d44165afff8/

Threat name:

Win32.Trojan.Kryptik

Status:

Malicious

First seen:

2020-07-16 06:56:06 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

23 of 29 (79.31%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=4iw4pyzn7ohc7h3vy4w632fuxp5nq3b6sdid664p7iwuifs2774a._file

Verdict:

malicious

Label(s):

icedid

Result

Malware family:

n/a

Score:

1/10

Tags:

n/a

Link:

https://tria.ge/reports/200716-9halk55fej/

Behaviour

Suspicious use of SetWindowsHookEx

Suspicious behavior: EnumeratesProcesses

Modifies system certificate store

Suspicious use of SetWindowsHookEx

Suspicious behavior: EnumeratesProcesses

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Cobalt_functions Create hunting rule
Author:	@j0sm1
Description:	Detect functions coded with ROR edi,D; Detect CobaltStrike used by differents groups APT