MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f6718e02bc73edf5aab341fa0a7f75782bc72f7dd1a6e1aadb1300e51cce06fc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


IcedID


Vendor detections: 5


Intelligence 5 IOCs 1 YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f6718e02bc73edf5aab341fa0a7f75782bc72f7dd1a6e1aadb1300e51cce06fc
SHA3-384 hash: d0c7b52fcbbe1b6da3cb87b21b6269e2467699abff95567928894a1dc5f079a8022e371ecb9b7e158970ef949373dbc8
SHA1 hash: 3500a11543f4903c2c4d6d0c4b1b5521d96a7b7b
MD5 hash: c8936062c8c9d0763c529954be94f829
humanhash: tennis-ten-mango-angel
File name:f6718e02bc73edf5aab341fa0a7f75782bc72f7dd1a6e.dll
Download: download sample
Signature IcedID
Create hunting rule
File size:54'272 bytes
First seen:2021-07-04 18:20:47 UTC
Last seen:2021-07-04 18:51:40 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 001d993cb52b06dd86f1aafa1c13bed8 (3 x IcedID)
ssdeep 1536:gs6MUTax9eySys3t+Hl1MfUx4dP9UQ2T2:gs6F0eaQ+Hl1Mfcy9UDT2
TLSH AE33E7B2FB7650D1E9D6C83E83067137F8623C1A9759A352FF7693831329A60E126713
Reporter abuse_ch
Tags:dll exe IcedID


Avatar
abuse_ch
IcedID C2:
piramidionno.life

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
piramidionno.life https://threatfox.abuse.ch/ioc/157351/

Intelligence

File Origin
# of uploads :
2
# of downloads :
519
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
f6718e02bc73edf5aab341fa0a7f75782bc72f7dd1a6e.dll
Verdict:
No threats detected
Analysis date:
2021-07-04 18:21:15 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/f22dcb04-06b1-4984-9b3d-95d3b743253b

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/169633/
Detection(s):
SecuriteInfo.com..31220.10145.UNOFFICIAL
Create hunting rule

Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/4186fa0d-ad44-4737-afa1-43f5c5fbe7a4
Result
Threat name:
IcedID
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
68 / 100
Link:
https://www.joesandbox.com/analysis/811621
Signature
Multi AV Scanner detection for domain / URL
System process connects to network (likely due to code injection or exploit)
Tries to detect virtualization through RDTSC time measurements
Yara detected IcedID
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 444032 Sample: f6718e02bc73edf5aab341fa0a7... Startdate: 04/07/2021 Architecture: WINDOWS Score: 68 28 piramidionno.life 2->28 62 Multi AV Scanner detection for domain / URL 2->62 64 Yara detected IcedID 2->64 8 loaddll64.exe 1 2->8         started        signatures3 process4 dnsIp5 42 piramidionno.life 8->42 44 tp.8e49140c2-frontier.amazon.com 8->44 46 2 other IPs or domains 8->46 70 Tries to detect virtualization through RDTSC time measurements 8->70 12 cmd.exe 8->12         started        14 regsvr32.exe 8->14         started        18 rundll32.exe 8->18         started        20 7 other processes 8->20 signatures6 process7 dnsIp8 22 rundll32.exe 12->22         started        48 piramidionno.life 172.67.195.139, 49727, 49728, 49731 CLOUDFLARENETUS United States 14->48 50 dr49lng3n1n2s.cloudfront.net 143.204.91.74, 443, 49723, 49724 AMAZON-02US United States 14->50 56 2 other IPs or domains 14->56 72 System process connects to network (likely due to code injection or exploit) 14->72 74 Tries to detect virtualization through RDTSC time measurements 14->74 58 2 other IPs or domains 18->58 52 piramidionno.life 20->52 54 tp.8e49140c2-frontier.amazon.com 20->54 60 3 other IPs or domains 20->60 26 iexplore.exe 5 155 20->26         started        signatures9 process10 dnsIp11 30 piramidionno.life 22->30 32 192.168.2.1 unknown unknown 22->32 38 3 other IPs or domains 22->38 66 System process connects to network (likely due to code injection or exploit) 22->66 68 Tries to detect virtualization through RDTSC time measurements 22->68 34 piramidionno.life 26->34 36 edge.gycpi.b.yahoodns.net 87.248.118.22, 443, 49826, 49827 YAHOO-DEBDE United Kingdom 26->36 40 11 other IPs or domains 26->40 signatures12
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f6718e02bc73edf5aab341fa0a7f75782bc72f7dd1a6e1aadb1300e51cce06fc/
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=6zyy4av4opw7lkvtih5au73vpav4ol352gtodkw3cmaokhgoa36a._file
Result
Malware family:
icedid
Create hunting rule
Score:
  10/10
Tags:
family:icedid campaign:3682528357 banker trojan
Link:
https://tria.ge/reports/210704-pbv68w971n/
Behaviour
Suspicious behavior: EnumeratesProcesses
IcedID, BokBot
Malware Config
C2 Extraction:
piramidionno.life
Unpacked files
SH256 hash:
f6718e02bc73edf5aab341fa0a7f75782bc72f7dd1a6e1aadb1300e51cce06fc
MD5 hash:
c8936062c8c9d0763c529954be94f829
SHA1 hash:
3500a11543f4903c2c4d6d0c4b1b5521d96a7b7b
Link:
https://www.unpac.me/results/2f291a04-6fe4-4343-824f-afae0af7f4a3/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Dropper
Score:
0.80
Link:
https://yomi.yoroi.company/submissions/f6718e02bc73edf5aab341fa0a7f75782bc72f7dd1a6e1aadb1300e51cce06fc

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:crime_win32_icedid_stage1
Create hunting rule
Author:Rony (@r0ny_123)
Description:Detects IcedID Photoloader
Reference:https://sysopfb.github.io/malware,/icedid/2020/04/28/IcedIDs-updated-photoloader.html
Rule name:IcedID
Create hunting rule
Author:@bartblaze
Description:Identifies IcedID (stage 1 and 2, loaders).
Rule name:MAL_IcedID_GZIP_LDR_202104
Create hunting rule
Author:Thomas Barabosch, Telekom Security
Description:2021 initial Bokbot / Icedid loader for fake GZIP payloads
Reference:https://www.telekom.com/en/blog/group/article/let-s-set-ice-on-fire-hunting-and-detecting-icedid-infections-627240
Rule name:win_iceid_gzip_ldr_202104
Create hunting rule
Author:Thomas Barabosch, Telekom Security
Description:2021 initial Bokbot / Icedid loader for fake GZIP payloads

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/169633/

Comments