MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f6ea31d1b674431a77384e8e84b15522055fc9c90fe7ca7e1f666d447277af41. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


IcedID


Vendor detections: 9


Intelligence 9 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f6ea31d1b674431a77384e8e84b15522055fc9c90fe7ca7e1f666d447277af41
SHA3-384 hash: b4a89a99229a869a1fb5253e0b7c94d6b1eb65a21aeb7dc8f95e84d68177467a13a1a3d3bf6a14566213151c55a79ec2
SHA1 hash: 21405e03bb9a929672d53c68b0d6d2facf24d394
MD5 hash: d72d6ddcbdf401c1b05da01824aabd92
humanhash: island-sodium-apart-robin
File name:d72d6ddcbdf401c1b05da01824aabd92.dll
Download: download sample
Signature IcedID
Create hunting rule
File size:53'248 bytes
First seen:2021-03-25 09:48:09 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 59cadf14099152052d1d9e7cd19dedf7 (120 x IcedID)
ssdeep 768:OhtkLEPNgcRjiKMulfwgggs30yGMtz9RWT/2KTeahM3J/IFmaD/:1Lybg+Ej30y7hE/casJ/IF5/
Threatray 165 similar samples on MalwareBazaar
TLSH AC333AC526D00B26C0311D73CAB24BDED21ABA90B76359F792C82774E792887CFB5C65
Reporter abuse_ch
Tags:dll IcedID

Intelligence

File Origin
# of uploads :
1
# of downloads :
137
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
d72d6ddcbdf401c1b05da01824aabd92.dll
Verdict:
No threats detected
Analysis date:
2021-03-25 09:53:17 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/195fad18-a2f5-441b-ad5e-64944fc2f1ee

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
SecuriteInfo.com..12661.14239.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Deleting a recently created file
Creating a file in the Windows subdirectories
Sending a UDP request
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
IcedID
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
68 / 100
Link:
https://www.joesandbox.com/analysis/653621
Signature
Multi AV Scanner detection for submitted file
System process connects to network (likely due to code injection or exploit)
Tries to detect virtualization through RDTSC time measurements
Yara detected IcedID
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f6ea31d1b674431a77384e8e84b15522055fc9c90fe7ca7e1f666d447277af41/
Threat name:
Win64.Trojan.Drixed
Create hunting rule
Status:
Malicious
First seen:
2021-03-25 09:49:06 UTC
AV detection:
14 of 48 (29.17%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=63vddunworbru5zyj2hijmkveicv7sojb7t4u7q7mzwui4txv5aq._file
Verdict:
malicious
Label(s):
icedid
Create hunting rule
Similar samples:
030e5a36570fb896b3e7b214784c0daa4f60bc60dd05540870ce1331aea2ef22
IcedID
0969dc2c7a5b0129733e4e2cc82c66f474157df3cf8ec00d756d91b3afda3d96
IcedID
0be20197536de0c1f34b289b1012add4f7fd06926f80947559fcf26b6edef39b
IcedID
31f22e685a69d098c3b7a02fe5c217842a245978f122a12ce2b2288cd76fcb08
IcedID
7f8505410e1e37d0f016c5db0d0446e52b3b79fc8f620568ac0101ee94bdb7b3
IcedID
a016e8442598e6862f7c77a0247ad3e5f5af7bdd1ea3b7bfa8a7053206000cc5
IcedID
c4bfe1f27b07c631ca1038b1115065bc1f26b9c723c3191bf12670f312d711a6
IcedID
d35580465d36c74af87fd9881bf8e59e136c70e48565cddc6f2d3a066c502c9a
IcedID
ef092d08c9c063fa752fa172e4cd52d43151b1def17ce245047bea5d0de494b8
IcedID
f85b5c4a909e0baad255177022c95c0f594240f789a60f3a920f87d4a81e22ef
IcedID
+ 155 additional samples on MalwareBazaar
Result
Malware family:
icedid
Create hunting rule
Score:
  10/10
Tags:
family:icedid banker loader trojan
Link:
https://tria.ge/reports/210325-safqylnrm6/
Behaviour
Suspicious behavior: EnumeratesProcesses
IcedID First Stage Loader
IcedID, BokBot
Malware Config
C2 Extraction:
feaser2347.club
Unpacked files
SH256 hash:
f6ea31d1b674431a77384e8e84b15522055fc9c90fe7ca7e1f666d447277af41
MD5 hash:
d72d6ddcbdf401c1b05da01824aabd92
SHA1 hash:
21405e03bb9a929672d53c68b0d6d2facf24d394
Link:
https://www.unpac.me/results/2828a502-8816-49f9-89ec-b44b27eb170e/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.80
Link:
https://yomi.yoroi.company/submissions/f6ea31d1b674431a77384e8e84b15522055fc9c90fe7ca7e1f666d447277af41

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:crime_win32_icedid_stage1
Create hunting rule
Author:Rony (@r0ny_123)
Description:Detects IcedID Photoloader
Reference:https://sysopfb.github.io/malware,/icedid/2020/04/28/IcedIDs-updated-photoloader.html

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

IcedID

Executable exe f6ea31d1b674431a77384e8e84b15522055fc9c90fe7ca7e1f666d447277af41

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1088409/
  
Delivery method
Distributed via web download

Comments