MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ed43bf5aa70a4f9181b57649f9cd7f0b50f0db3bc83b98ccdc94c1112be05d71. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


IcedID


Vendor detections: 7


Intelligence 7 IOCs 1 YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ed43bf5aa70a4f9181b57649f9cd7f0b50f0db3bc83b98ccdc94c1112be05d71
SHA3-384 hash: da93e56c81c0d4b84871c5be0bab715a6506edbfe4a835e93991e28fcdc0f0650bf54ec3c4e385f52461241b2a60360d
SHA1 hash: a8f82ea11792696a39e4c33d48d8109bc2bacbc5
MD5 hash: 3d4f3b34d781f4f413863dc0d31192dc
humanhash: east-football-uniform-magazine
File name:3d4f3b34d781f4f413863dc0d31192dc.dll
Download: download sample
Signature IcedID
Create hunting rule
File size:614'400 bytes
First seen:2022-06-17 16:22:02 UTC
Last seen:2022-06-17 16:40:35 UTC
File type:Executable exe
MIME type:application/x-dosexec
ssdeep 12288:E0s2tpsfoVvnMDvlDDw+DhSj3nQIyzvadokr2EnB/6bQT9YofWHKfugOM:E09WAyDtE+D4j9yzvS/LnByWHOHWuPM
TLSH T152D4BFB875047DE6A67F467BCA96BDDD13B627629A87A4CD8064B7C305A3331FF02804
TrID 33.6% (.EXE) OS/2 Executable (generic) (2029/13)
33.1% (.EXE) Generic Win/DOS Executable (2002/3)
33.1% (.EXE) DOS Executable Generic (2000/1)
Reporter abuse_ch
Tags:dll exe IcedID


Avatar
abuse_ch
IcedID C2:
didojanza.com

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
didojanza.com https://threatfox.abuse.ch/ioc/699414/

Intelligence

File Origin
# of uploads :
2
# of downloads :
285
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/281027/
Detection(s):
SecuriteInfo.com.Trojan.GenericKD.49171335.2804.31815.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Searching for the window
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/62acaa6c6ca90a5b22c84639/reports/b7986ce1-3348-41e7-b4c4-c42fa728ee77/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/aa2964c6-a36c-4ec1-a681-2b9bb4c40163
Result
Threat name:
IcedID
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1015364
Signature
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Contains functionality to detect hardware virtualization (CPUID execution measurement)
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
System process connects to network (likely due to code injection or exploit)
Tries to detect virtualization through RDTSC time measurements
Yara detected IcedID
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ed43bf5aa70a4f9181b57649f9cd7f0b50f0db3bc83b98ccdc94c1112be05d71/
Threat name:
Win64.Trojan.IcedID
Create hunting rule
Status:
Malicious
First seen:
2022-06-14 11:51:10 UTC
File Type:
PE+ (Dll)
Extracted files:
1
AV detection:
14 of 26 (53.85%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=5vb36wvhbjhzdanvoze7ttl7bnipbwz3za5zrtg4starck7alvyq._file
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/220617-tt8fzafbd5/
Unpacked files
SH256 hash:
4a4d7cf3bfff4c2c46727169e08dbe669b2e451b530511882cda00606c4e7474
MD5 hash:
1c17fe6177ff46aff865b6d675226bdf
SHA1 hash:
3240984f74672953985f36e3ac1b2ef6b3313971
Detections:
win_photoloader_auto
Create hunting rule
win_photoloader_a0
Create hunting rule
Link:
https://www.unpac.me/results/ef3c3296-43dd-49b5-a267-26602a5e4326/
Parent samples :
a29dd1e5e365ef6dd13a26ed08311c1a5436cd8fcb5f837c1826b2805e70b0b4
b3b19214a3357658687eabfb159176d5c223ca1a80fd642a3ebf218decc7a748
9eec70034e7e1a0fceda35bfab123ecef7baa719f5d23224b236983cf1b95659
9719165831438c3255b81edd50f1d9473a57b06e9794f9f0d099fc78582f7779
ed43bf5aa70a4f9181b57649f9cd7f0b50f0db3bc83b98ccdc94c1112be05d71
9b2860852604f0d78f1dfc8e42a01cc3496eb3b6da2cc5cfaf9c3b92d82b69ca
8603f8be48712ce018191f5f8d8f32003f16c286876866aa61e701fc198c9a78
dd636623af52a3708dc43af228ff5bd12f874acb6d9be92ed58642c515ba8fe2
1a9b3d506e58c53448e784a61849bcdb6494ba427f7bedbed6b887f1586aac7e
8190716008970cc6de36035ad1c403e833ba1f2b573cbf0eee723558783d2065
59442e454336e739c1e698e97b524973803300ce32b3d671e65c64e9b8032800
20f825cd68b183f9ce5dd3448e75b48a935eb51b077edb6dd595ea388b75b0a3
1f84e1d59a892c266ae192aaad311d4b66671f5bf7ce7029bd902a4859bb3e12
283cf54e73056f4e644496d2a9bf4fc61a0fca4379ffbd1543da371d5df6320d
14d20132b72f71aa405b34060416c574a3412be2e5f5b027a19d2ae3683e86c5
SH256 hash:
ed43bf5aa70a4f9181b57649f9cd7f0b50f0db3bc83b98ccdc94c1112be05d71
MD5 hash:
3d4f3b34d781f4f413863dc0d31192dc
SHA1 hash:
a8f82ea11792696a39e4c33d48d8109bc2bacbc5
Link:
https://www.unpac.me/results/ef3c3296-43dd-49b5-a267-26602a5e4326/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/ed43bf5aa70a4f9181b57649f9cd7f0b50f0db3bc83b98ccdc94c1112be05d71

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:SPLCrypt
Create hunting rule
Author:James Quinn, Binary Defense
Description:Identifies SPLCrypt, a new crypter associated with Bazaloader

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/281027/

Comments