🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ea52295b81ac4877523c84178555974c4afaa905d6b8009859eaf82b3d3c5921. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


IcedID


Vendor detections: 12


Intelligence 12 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ea52295b81ac4877523c84178555974c4afaa905d6b8009859eaf82b3d3c5921
SHA3-384 hash: 64c930014c2039dec873a7ce1271c6ce2a1ae5ae29f7ed4510fe4a95562d5196e82173909704cd9b5d2775c060f0f625
SHA1 hash: a0ca31506a4e8be1ed02c326108e4004d6498048
MD5 hash: 90251ca3d9861e0952d003244d2ca6c7
humanhash: table-winner-vegan-bluebird
File name:90251ca3d9861e0952d003244d2ca6c7.exe
Download: download sample
Signature IcedID
Create hunting rule
File size:498'688 bytes
First seen:2023-09-29 08:51:41 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash ac10be1410cedfb63246b3c00364b751 (1 x IcedID)
ssdeep 3072:ZdkL0HXUnmwaut09pYNWfxjP7+w4Ooxd4BlDUwRq5snio2fWKIulMdtb6n36Wk3x:ZaS+mY09pYEljloX0n9K43WOJ
Threatray 9 similar samples on MalwareBazaar
TLSH T128B4D5E43005865FF758CCBE5ADCE198F16CDD724BA701A2A73C2C76C678C1EAD89624
TrID 47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
15.9% (.EXE) Win64 Executable (generic) (10523/12/4)
9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
6.8% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon 71e8f0e0e2b2dc71 (10 x AgentTesla, 2 x IcedID, 1 x NanoCore)
Reporter abuse_ch
Tags:exe IcedID

Intelligence

File Origin
# of uploads :
1
# of downloads :
370
Origin country :
NL NL
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
90251ca3d9861e0952d003244d2ca6c7.exe
Verdict:
No threats detected
Analysis date:
2023-09-29 09:10:21 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/364e256d-0e12-4cfe-81a7-bd6a358c97a5

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
Win.Dropper.IcedID-7372260-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Sending a custom TCP request
Сreating synchronization primitives
Launching a process
Creating a file
Unauthorized injection to a system process
Enabling autorun by creating a file
Gathering data
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
bokbot fuerboos greyware icedid ursnif
Link:
https://www.filescan.io/uploads/6516903983a0c6425d0279cc/reports/c171607e-fbd5-4066-acfd-985f4d772482/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/ea52295b81ac4877523c84178555974c4afaa905d6b8009859eaf82b3d3c5921
Malware family:
TrickBot
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/7dc23964-14d4-49d5-a2f2-1fab86072704
Result
Threat name:
IcedID
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1316289
Signature
Allocates memory in foreign processes
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
C2 URLs / IPs found in malware configuration
Contains functionality to compare user and computer (likely to detect sandboxes)
Contains functionality to detect hardware virtualization (CPUID execution measurement)
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found malware configuration
Hijacks the control flow in another process
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Overwrites code with unconditional jumps - possibly settings hooks in foreign process
Tries to detect virtualization through RDTSC time measurements
Writes to foreign memory regions
Yara detected IcedID
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1316289 Sample: zypxnDHPnB.exe Startdate: 29/09/2023 Architecture: WINDOWS Score: 100 41 Found malware configuration 2->41 43 Malicious sample detected (through community Yara rule) 2->43 45 Antivirus detection for dropped file 2->45 47 6 other signatures 2->47 6 zypxnDHPnB.exe 2->6         started        9 loflof.exe 2->9         started        11 losuvg.exe 2->11         started        13 2 other processes 2->13 process3 signatures4 49 Detected unpacking (changes PE section rights) 6->49 51 Detected unpacking (overwrites its own PE header) 6->51 53 Overwrites code with unconditional jumps - possibly settings hooks in foreign process 6->53 15 svchost.exe 5 6->15         started        55 Antivirus detection for dropped file 9->55 57 Hijacks the control flow in another process 9->57 59 Machine Learning detection for dropped file 9->59 19 svchost.exe 5 9->19         started        61 Writes to foreign memory regions 11->61 63 Allocates memory in foreign processes 11->63 65 Contains functionality to compare user and computer (likely to detect sandboxes) 11->65 21 svchost.exe 5 11->21         started        23 svchost.exe 5 13->23         started        25 svchost.exe 5 13->25         started        process5 file6 27 C:\ProgramData\...\tsuvts.exe, PE32 15->27 dropped 37 Contains functionality to detect hardware virtualization (CPUID execution measurement) 15->37 39 Tries to detect virtualization through RDTSC time measurements 15->39 29 C:\ProgramData\...\losuvg.exe, PE32 19->29 dropped 31 C:\ProgramData\...\hzvgbwjncm.exe, PE32 21->31 dropped 33 C:\ProgramData\...\loflof.exe, PE32 23->33 dropped 35 C:\ProgramData\...\czicmenc.exe, PE32 25->35 dropped signatures7
Detection:
icedid
Create hunting rule
Link:
https://mwdb.cert.pl/sample/ea52295b81ac4877523c84178555974c4afaa905d6b8009859eaf82b3d3c5921/
Threat name:
Win32.Trojan.Ursnif
Create hunting rule
Status:
Malicious
First seen:
2018-12-26 23:54:57 UTC
File Type:
PE (Exe)
Extracted files:
17
AV detection:
33 of 38 (86.84%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=5jjcsw4bvrehour4qqlykvmxjrfpvkif224abgcz5l4cwpj4leqq._file
Verdict:
malicious
Label(s):
icedid
Create hunting rule
Similar samples:
24503419c21a345173822bd36297c8815e8f91c78c0d46211f33a1738479238a
IcedID
2673588603fc2203117206d4a318eb7aa20bd88c94342f27cb9207e56216c186
IcedID
3c3024e4c2b075b12063e4af1bb3886d4e7ee25e8d1bb4fc52ea51535ab1e1ae
IcedID
4870f3c3fd4c93b075a210d92177429b649e038f112b6df89325157d8c0f185a
IcedID
b89ab9559b9f53fa5cd8ca76918902e1be2c3b749d755566ca784ea7ffa48fc3
IcedID
ea0fb0dc663dcb83869c83db63565e8e69a1caac665f789a58b1c98b7ecd64e0
IcedID
eed8a89080cb158492a0a8a623a4699c73e3edce560f23e7ca948a5ff0fc810e
IcedID
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/230929-ksrbmagh8v/
Behaviour
Suspicious use of WriteProcessMemory
Unpacked files
SH256 hash:
d344dcb7924612c54618fdce2f0105c3f8b117cf226a897391e6fbaa03cf9cf5
MD5 hash:
8efdc10e68a7a9e2206b1e2b7f804a59
SHA1 hash:
8737dd335770a12a956e65c81c284d15edb8fbb8
Detections:
win_icedid_auto
Create hunting rule
Link:
https://www.unpac.me/results/b6e27e45-cc88-4c53-aeaf-e371811f4249/
SH256 hash:
ea52295b81ac4877523c84178555974c4afaa905d6b8009859eaf82b3d3c5921
MD5 hash:
90251ca3d9861e0952d003244d2ca6c7
SHA1 hash:
a0ca31506a4e8be1ed02c326108e4004d6498048
Link:
https://www.unpac.me/results/b6e27e45-cc88-4c53-aeaf-e371811f4249/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/ea52295b81ac/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/ea52295b81ac4877523c84178555974c4afaa905d6b8009859eaf82b3d3c5921

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments