MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 eda6bb813cee36866a58cc01b6c928484e8751e3c442ec9739f798aeb8e453f9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


IcedID


Vendor detections: 10


Intelligence 10 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: eda6bb813cee36866a58cc01b6c928484e8751e3c442ec9739f798aeb8e453f9
SHA3-384 hash: 36b97de27d2a3338dce74372abe36650b94ba18a1633f32dea40d44b54cf81b2e8abb6233987d9fca685f90e8f3a8bfd
SHA1 hash: e8992a283f9f37dec617b305db2790d9112d3a20
MD5 hash: 4526907573a050a8585a1cb03e926e81
humanhash: beer-timing-massachusetts-autumn
File name:SecuriteInfo.com.Trojan.Win32.Sabsik.FL.Bml.30916.19653
Download: download sample
Signature IcedID
Create hunting rule
File size:1'305'088 bytes
First seen:2021-12-03 00:51:57 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash ce912851a3738c184ce2626b46d20835 (1 x IcedID)
ssdeep 24576:ZD0Ejqw95oEKe3UyVlViimjKaH1S2uK7SPFL3EOGTWqG5QVEzAJ24GOy2i5b8+Dq:d0be3UyVlVFmjKaH1S237SPFL3EOGTWi
Threatray 23 similar samples on MalwareBazaar
TLSH T1C155D587EA6361E0E4BBD23486A6772BB97135148334C7CB87454B174B22FF4A97E384
Reporter SecuriteInfoCom
Tags:exe IcedID

Intelligence

File Origin
# of uploads :
1
# of downloads :
297
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
SecuriteInfo.com.Trojan.Win32.Sabsik.FL.Bml.30916.19653
Verdict:
No threats detected
Analysis date:
2021-12-03 00:53:08 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/b31eeed0-a08d-4671-bab4-bea15ec0e338

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/210914/
Detection(s):
SecuriteInfo.com.Trojan.Win32.Sabsik.FL.Bml.30916.19653.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
DNS request
Sending a custom TCP request
Sending an HTTP GET request
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/610/overview
Behaviour
MeasuringTime
CheckCmdLine
EvasionQueryPerformanceCounter
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
67%
Tags:
greyware icedid
Link:
https://www.filescan.io/uploads/61a96a354d8e6f3a5e0bf5e0/reports/caec9566-d5ee-491d-82a3-94f1d9c0fe13/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
IcedID
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/40d91f8a-0456-4e26-9e6a-90f2956ca3ac
Result
Threat name:
IcedID
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
92 / 100
Link:
https://www.joesandbox.com/analysis/900612
Signature
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Contains functionality to detect hardware virtualization (CPUID execution measurement)
Detected unpacking (creates a PE file in dynamic memory)
Found malware configuration
Tries to detect virtualization through RDTSC time measurements
Yara detected IcedID
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/eda6bb813cee36866a58cc01b6c928484e8751e3c442ec9739f798aeb8e453f9/
Threat name:
Win64.Trojan.IcedID
Create hunting rule
Status:
Malicious
First seen:
2021-12-02 23:56:28 UTC
File Type:
PE+ (Exe)
AV detection:
13 of 28 (46.43%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
icedid
Create hunting rule
Similar samples:
01563f8120225436d86eb915c4ccdf97a78fda65c4b3fa613a30e3faf0f35840
IcedID
0f8c4123a1849e5b877422d80ce94199cc3be7cb77801fd0ba944fe595ffc382
IcedID
1d08bcc9e5ed8f7bbc161f81790198f8100e9a34952ccf4227f2625c6a15f445
IcedID
2b29c80a4829d3dc816b99606aa5aeead3533d24137f79b5c9a8407957e97b10
IcedID
8542e790264aead4545ac9debccff734d9dbe33993c5a419361befb87ea4a79a
IcedID
8b971c2c4c9a020eb274c36db20bc0e1b203a7909d63f48f99bef5594110929f
IcedID
c1ff5e402a811df59ac3ab7e16ac68c25b47f5ea7c6930f7799c72389ef06045
IcedID
+ 13 additional samples on MalwareBazaar
Result
Malware family:
icedid
Create hunting rule
Score:
  10/10
Tags:
family:icedid campaign:2539295706 banker trojan
Link:
https://tria.ge/reports/211203-a73yvsgcg9/
Behaviour
Modifies system certificate store
Suspicious behavior: EnumeratesProcesses
IcedID, BokBot
Malware Config
C2 Extraction:
endofyour.ink
Unpacked files
SH256 hash:
eda6bb813cee36866a58cc01b6c928484e8751e3c442ec9739f798aeb8e453f9
MD5 hash:
4526907573a050a8585a1cb03e926e81
SHA1 hash:
e8992a283f9f37dec617b305db2790d9112d3a20
Link:
https://www.unpac.me/results/c1313c9b-bc98-417f-b7a4-80cb307eadf0/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/eda6bb813cee36866a58cc01b6c928484e8751e3c442ec9739f798aeb8e453f9

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:MAL_BazarLoader_Oct_2021_1
Create hunting rule
Author:Arkbird_SOLG
Description:Detect BazarLoader implant
Reference:https://twitter.com/malwrhunterteam/status/1454154412902002692

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

IcedID

Executable exe eda6bb813cee36866a58cc01b6c928484e8751e3c442ec9739f798aeb8e453f9

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1845837/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/210914/

Comments