🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e707a4afcdc19fed71c19f48599a520ce2bade98bac5eaae5f19416c6d4e8912. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


IcedID


Vendor detections: 5


Intelligence 5 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e707a4afcdc19fed71c19f48599a520ce2bade98bac5eaae5f19416c6d4e8912
SHA3-384 hash: ccf122deaef90764240c5c5e9718f8a7a87689298115bb89119e3b11cc8acb71d21e94a55ff759a530d78b021b6e5013
SHA1 hash: 6b25581a2c23875f66422a27cc41fe0ffe058f1f
MD5 hash: c5b2ee8f379a85e7389997125d13d18a
humanhash: muppet-wyoming-charlie-stairway
File name:3031.html
Download: download sample
Signature IcedID
Create hunting rule
File size:845'595 bytes
First seen:2022-12-07 18:06:50 UTC
Last seen:Never
File type: html
MIME type:text/html
ssdeep 12288:8pGk4pmXwIaDjTibhUP7theeBnwU5upGk4pf:DkavImOyJBrkaf
TLSH T184051278CD2C97AE5AE0681D54BD1609AFB05D1B8087F8C97D9FB8078B9ED14022F7D8
Reporter proxylife
Tags:3738574432 html IcedID

Intelligence

File Origin
# of uploads :
1
# of downloads :
248
Origin country :
RU RU
Vendor Threat Intelligence
Detection(s):
Html.Trojan.QBot-9980274-0
Create hunting rule

TwinWave.EvilHTML.QakySoWaky.20221202.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
qbot
Link:
https://www.filescan.io/uploads/6390d6480c6473d16719d38a/reports/8d6bceca-4335-4928-8f44-36ecf2d51557/overview
Result
Threat name:
HtmlDropper
Create hunting rule
Detection:
malicious
Classification:
troj
Score:
52 / 100
Link:
https://www.joesandbox.com/analysis/1130203
Signature
Uses 7zip to decompress a password protected archive
Yara detected Html Dropper
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 762929 Sample: 3031.html Startdate: 07/12/2022 Architecture: WINDOWS Score: 52 39 Yara detected Html Dropper 2->39 8 chrome.exe 20 13 2->8         started        11 chrome.exe 2->11         started        process3 dnsIp4 33 192.168.2.1 unknown unknown 8->33 35 192.168.2.3 unknown unknown 8->35 37 239.255.255.250 unknown Reserved 8->37 13 unarchiver.exe 5 8->13         started        16 chrome.exe 8->16         started        process5 dnsIp6 41 Uses 7zip to decompress a password protected archive 13->41 19 7za.exe 1 13->19         started        21 7za.exe 1 13->21         started        27 clients.l.google.com 142.250.185.206, 443, 49697 GOOGLEUS United States 16->27 29 accounts.google.com 172.217.23.109, 443, 49696 GOOGLEUS United States 16->29 31 3 other IPs or domains 16->31 signatures7 process8 process9 23 conhost.exe 19->23         started        25 conhost.exe 21->25         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e707a4afcdc19fed71c19f48599a520ce2bade98bac5eaae5f19416c6d4e8912/
Threat name:
Script-JS.Trojan.Heuristic
Create hunting rule
Status:
Malicious
First seen:
2022-12-07 07:07:59 UTC
File Type:
Text (HTML)
Extracted files:
4
AV detection:
6 of 39 (15.38%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=44d2jl6nygp624obt5eftgssbtrlvxuyxlc6vls7dfawy3koreja._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.16
Link:
https://yomi.yoroi.company/submissions/e707a4afcdc19fed71c19f48599a520ce2bade98bac5eaae5f19416c6d4e8912

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:BitcoinAddress
Create hunting rule
Author:Didier Stevens (@DidierStevens)
Description:Contains a valid Bitcoin address
Rule name:MAL_QBot_HTML_Smuggling_Indicators_Oct22_1
Create hunting rule
Author:Florian Roth
Description:Detects double encoded PKZIP headers as seen in HTML files used by QBot
Reference:https://twitter.com/ankit_anubhav/status/1578257383133876225?s=20&t=Bu3CCJCzImpTGOQX_KGsdA
Rule name:QbotStuff
Create hunting rule
Author:anonymous
Rule name:QBOT_HTMLSmuggling_a
Create hunting rule
Author:Ankit Anubhav - ankitanubhav.info
Description:Detects QBOT HTML smuggling variants

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments