MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f3ba5d0b27ff406dcd1c624aee919f394d231b878f040ec23e36c7f0cf81df99. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry



IcedID


Vendor detections: 5


Intelligence 5 IOCs YARA 1 File information Comments

SHA256 hash: f3ba5d0b27ff406dcd1c624aee919f394d231b878f040ec23e36c7f0cf81df99
SHA3-384 hash: a9f8edb2dc98af379a2dc5228725164c5a9953f4b107ae041332cf8310a0b6b018455dae7134cee3c0ef7f1c864b0a38
SHA1 hash: b94d6c4de452f2265ec99281f86f6dc8e7ae0650
MD5 hash: 93eb0c2deb12a196869de85845efde47
humanhash: vegan-cardinal-quebec-earth
File name:f3ba5d0b27ff406dcd1c624aee919f394d231b878f040ec23e36c7f0cf81df99
Download: download sample
Signature IcedID
File size:220'160 bytes
First seen:2020-06-03 15:02:03 UTC
Last seen:2020-06-05 10:09:33 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash b8b96c56613affec66230c4e3db1ee91 (25 x IcedID, 1 x TrickBot)
ssdeep 3072:ZTlccpug9oWl3lo3wvo/+a6uKKpjCUUKI9joN9pOxhrLuvj:Z2c3l1uwwPKI3UKFvEx5L
TLSH 98248C0177C180B0D87A02350929AB91553EFCB14FB1676B2799BF9E5EB4280BF357A3
Reporter @raashidbhatt
Tags:exe IcedID

Intelligence


File Origin
# of uploads :
5
# of downloads :
85
Origin country :
FR FR
Mail intelligence
No data
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Trickbot
Status:
Malicious
First seen:
2020-06-03 04:08:24 UTC
AV detection:
22 of 31 (70.97%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a

YARA Signatures


MalareBazaar uses YARA rules from several public and non-public repositories, such as Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious proccess dumps they may create. Please note that only results from TLP:WHITE rules are being displayeyd.

Rule name:Cobalt_functions
Author:@j0sm1
Description:Detect functions coded with ROR edi,D; Detect CobaltStrike used by differents groups APT

File information


The table below shows additional information about this malware sample such as delivery method and external references.

Comments