MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f40d5de29f60ca2317e834e576151201847d645ceeb9fbdb7e092a6dbf7ef635. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

IcedID

Vendor detections: 14

Intelligence 14 IOCs YARA 8 File information Comments

SHA256 hash:	f40d5de29f60ca2317e834e576151201847d645ceeb9fbdb7e092a6dbf7ef635
SHA3-384 hash:	063ae934f2c0811aebf924cb7c6838a569ab6e0401870b7e3664f191ea3b5fa10480107d9fe71cb040fd8dae4d1269fd
SHA1 hash:	9737a2cbe4440344bbf2d6df27483c4928b74c5c
MD5 hash:	ed8b31f189b814ff688e2f9de987d180
humanhash:	friend-hot-queen-delta
File name:	f40d5de29f60ca2317e834e576151201847d645ceeb9fbdb7e092a6dbf7ef635
Download:	download sample
Signature	IcedID Create hunting rule
File size:	10'752 bytes
First seen:	2024-05-06 11:52:22 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	5a8049d632f4eb2fc4735faed7b61978 (3 x IcedID)
ssdeep	192:5piF7hWH0iI8jKWE2uNB+PEwtDtfSEdSrRJCfbpfSbxNPDt:KNh8q8joRmPEi5SV6sbxNP
Threatray	643 similar samples on MalwareBazaar
TLSH	T1672249EFAD270BA0EFB690F502AAD007ECBA71154D6F0853FA015AC29D315107D6EF22
TrID	56.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 11.8% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 9.0% (.EXE) Win16 NE executable (generic) (5038/12/1) 8.1% (.EXE) Win32 Executable (generic) (4504/4/1) 3.7% (.ICL) Windows Icons Library (generic) (2059/9)
Reporter	0x0d4y
Tags:	exe IcedID

Intelligence

File Origin

# of uploads :

# of downloads :

609

Origin country :

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

f40d5de29f60ca2317e834e576151201847d645ceeb9fbdb7e092a6dbf7ef635.exe

Verdict:

Malicious activity

Analysis date:

2024-05-06 11:55:20 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/f653293a-2560-4eef-8cad-93114fbd4ff6

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection(s):

Win.Downloader.Icedid-9754950-0

Result

Verdict:

Malware

Maliciousness:

Behaviour

Searching for the window

DNS request

Connection attempt

Sending a custom TCP request

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

anti-vm icedid razy

Link:

https://www.filescan.io/uploads/6638c4a354aa07c307ed38dd/reports/eb8cddf0-149f-4fe0-b79b-a5713f2cacf9/overview

Verdict:

Malicious

Labled as:

Win/malicious_confidence_100%

Link:

https://www.hybrid-analysis.com/sample/f40d5de29f60ca2317e834e576151201847d645ceeb9fbdb7e092a6dbf7ef635

Malware family:

PhotoLoader

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/33c6bed6-6727-4505-b1bd-530f4df31631

Result

Threat name:

IcedID

Detection:

malicious

Classification:

troj.evad

Score:

80 / 100

Link:

https://www.joesandbox.com/analysis/1436717

Signature

Antivirus / Scanner detection for submitted sample

Contains functionality to detect hardware virtualization (CPUID execution measurement)

Machine Learning detection for sample

Multi AV Scanner detection for submitted file

Yara detected IcedID

Behaviour

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/f40d5de29f60ca2317e834e576151201847d645ceeb9fbdb7e092a6dbf7ef635

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/f40d5de29f60ca2317e834e576151201847d645ceeb9fbdb7e092a6dbf7ef635/

Threat name:

Win32.Trojan.IcedID

Status:

Malicious

First seen:

2024-04-06 06:53:49 UTC

File Type:

PE (Exe)

AV detection:

29 of 38 (76.32%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=6qgv3yu7mdfcgf7igtsxmfisagch2zc45247xw36bevg3p366y2q._file

Verdict:

malicious

IcedID

1ba3155c2aaccd134237b8ff6864bb3e5c05fefaace410f2c705dd6bb43030ba

IcedID

30f099660904079afcd445409cfd2eca735fab49dda522f03ed60d47f9f21bdc

IcedID

5bd66c88148005029d20c92e1d793f8d41f47a273a9334f9a85ec31148d0b040

IcedID

65ce2081be589354f2b1354ce17e624b18dab29d377190fdc1e88bb5ab8e59a3

IcedID

a2e683ed3b00ce43517b0ffa99177b19e18ab4c0a27198082e2197801f22b0ed

IcedID

a9691e506636f78293fac9fcdd9bfa1efb3c94b45452d0351ed8db489d65cee8

IcedID

c1409888629a9131e216a8c83268681408a17363dbff289cac4b5aab0518caf1

IcedID

d67565a9eaab32345275e8800d91a45df86b09bc4312d0fc96a2b7eaf18f477f

IcedID

+ 633 additional samples on MalwareBazaar

Result

Malware family:

icedid

Score:

10/10

Tags:

family:icedid loader

Link:

https://tria.ge/reports/240506-n2al1sag9t/

Unpacked files

SH256 hash:

f40d5de29f60ca2317e834e576151201847d645ceeb9fbdb7e092a6dbf7ef635

MD5 hash:

ed8b31f189b814ff688e2f9de987d180

SHA1 hash:

9737a2cbe4440344bbf2d6df27483c4928b74c5c

Detections:

win_photoloader_auto

win_photoloader_a0

IcedID_init_loader

Link:

https://www.unpac.me/results/ace36e02-8d10-47cc-8448-14e371af7bc6/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/f40d5de29f60ca2317e834e576151201847d645ceeb9fbdb7e092a6dbf7ef635

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	crime_win32_icedid_stage1 Create hunting rule
Author:	Rony (@r0ny_123)
Description:	Detects IcedID photoloader
Reference:	https://sysopfb.github.io/malware,/icedid/2020/04/28/IcedIDs-updated-photoloader.html

Rule name:	IcedIDLoader Create hunting rule
Author:	kevoreilly, threathive, enzo, r0ny123
Description:	IcedID Loader

Rule name:	IcedIDStage1 Create hunting rule
Author:	kevoreilly, threathive, enzo
Description:	IcedID Payload

Rule name:	icedid_2stager Create hunting rule
Author:	0x0d4y
Description:	This rule detects samples from the IcedID family unpacked in memory, identifying code reuse of key functions.
Reference:	https://0x0d4y.blog/icedid-technical-analysis/

Rule name:	IcedID_init_loader Create hunting rule
Author:	@bartblaze
Description:	Identifies IcedID (stage 1 and 2, initial loaders).

Rule name:	icedid_unpacked Create hunting rule
Author:	0x0d4y
Description:	This rule detects samples from the IcedID family unpacked in memory, identifying code reuse of key functions.
Reference:	https://0x0d4y.blog/icedid-technical-analysis/

Rule name:	Icedid_Unpacked_in_Memory Create hunting rule
Author:	0x0d4y
Description:	This rule detects samples from the IcedID family unpacked in memory, identifying code reuse of key functions.
Reference:	https://0x0d4y.blog/icedid-technical-analysis/

Rule name:	win_photoloader_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	Detects win.photoloader.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Link

https://0x0d4y.blog/icedid-technical-analysis/

Malpedia

https://malpedia.caad.fkie.fraunhofer.de/details/win.icedid

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings

ID	Title	Severity
CHECK_AUTHENTICODE	Missing Authenticode	high
CHECK_DLL_CHARACTERISTICS	Missing dll Security Characteristics (HIGH_ENTROPY_VA)	high
CHECK_NX	Missing Non-Executable Memory Protection	critical

Reviews

ID	Capabilities	Evidence
WIN32_PROCESS_API	Can Create Process and Threads	KERNEL32.dll::CloseHandle WINHTTP.dll::WinHttpCloseHandle
WIN_BASE_API	Uses Win Base API	KERNEL32.dll::LoadLibraryA KERNEL32.dll::GetCommandLineA
WIN_BASE_IO_API	Can Create Files	KERNEL32.dll::CreateFileA KERNEL32.dll::GetTempPathA
WIN_BASE_USER_API	Retrieves Account Information	ADVAPI32.dll::GetUserNameA ADVAPI32.dll::LookupAccountNameW
WIN_HTTP_API	Uses HTTP services	WINHTTP.dll::WinHttpAddRequestHeaders WINHTTP.dll::WinHttpConnect WINHTTP.dll::WinHttpOpen WINHTTP.dll::WinHttpOpenRequest WINHTTP.dll::WinHttpQueryDataAvailable WINHTTP.dll::WinHttpQueryHeaders

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample