MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fb1484a7ccc41e954702a9bb1deb647125403a6096afb767dd8d7fbad9d13703. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

IcedID

Vendor detections: 14

Intelligence 14 IOCs YARA 8 File information Comments

SHA256 hash:	fb1484a7ccc41e954702a9bb1deb647125403a6096afb767dd8d7fbad9d13703
SHA3-384 hash:	2339be56275865b22a0fe1d3a47e2da8883a8a7996466e427fb018f42682f0d48376e0576c4846ffcd5c82a3798b5513
SHA1 hash:	ffaa8079e219cb1bc37f331ba250b4630aec8d9c
MD5 hash:	c75af3a0676a5849098232dd5e1fc9b7
humanhash:	freddie-purple-summer-oven
File name:	Scan_Doc_07-26(214).exe
Download:	download sample
Signature	IcedID Create hunting rule
File size:	477'360 bytes
First seen:	2023-07-26 15:15:28 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	122ad25046a6ae342251fe184815d102 (6 x IcedID)
ssdeep	12288:A4C1uGMdmiY1M4IhevqeEbwSPeh4Yjkp9EPWoiZMshpG:A4C8GMEvohcUIvKGPWoRYpG
Threatray	156 similar samples on MalwareBazaar
TLSH	T196A4F18AD2310AF3DD76C53FD8E14046D6713C87AA11DA1F226842297FB31B14FABB65
TrID	48.7% (.EXE) Win64 Executable (generic) (10523/12/4) 23.3% (.EXE) Win16 NE executable (generic) (5038/12/1) 9.3% (.EXE) OS/2 Executable (generic) (2029/13) 9.2% (.EXE) Generic Win/DOS Executable (2002/3) 9.2% (.EXE) DOS Executable Generic (2000/1)
Reporter	k3dg3___
Tags:	3297324279 exe IcedID signed

Code Signing Certificate

Organisation:	KOZUZ SP. Z O.O.
Issuer:	Certum Extended Validation Code Signing 2021 CA
Algorithm:	sha256WithRSAEncryption
Valid from:	2023-05-18T11:35:48Z
Valid to:	2024-05-17T11:35:47Z
Serial number:	2a2f270535c2d5e7630720fb229b5d1c
Intelligence:	12 malware samples on MalwareBazaar are signed with this code signing certificate
MalwareBazaar Blocklist:	This certificate is on the MalwareBazaar code signing certificate blocklist (CSCB)
Cert Graveyard Blocklist:	This certificate is on the Cert Graveyard blocklist
Thumbprint Algorithm:	SHA256
Thumbprint:	73a0cc4495a49492806b970fd844a0ab078126930305d22c7bf68b43c337fc1a
Source:	This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin

# of uploads :

# of downloads :

349

Origin country :

Vendor Threat Intelligence

Malware family:

icedid

ID:

File name:

Scan_Doc_07-26(214).exe

Verdict:

Malicious activity

Analysis date:

2023-07-26 15:17:20 UTC

Tags:

icedid bokbot

Link:

https://app.any.run/tasks/b18f0c10-cabe-4975-9b00-520ba85bbb7b

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

IcedIDLoader

Link:

https://www.capesandbox.com/analysis/434033/

Detection(s):

SecuriteInfo.com.Trojan.IcedID.224.6695.29244.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Sending a custom TCP request

DNS request

Sending an HTTP GET request

Gathering data

Verdict:

Malicious

Labled as:

Malware

Link:

https://www.hybrid-analysis.com/sample/fb1484a7ccc41e954702a9bb1deb647125403a6096afb767dd8d7fbad9d13703

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

GzipLoader

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/b94ea68c-b17a-4cd8-99e4-384b19433a18

Result

Threat name:

IcedID

Detection:

malicious

Classification:

troj.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1280292

Signature

C2 URLs / IPs found in malware configuration

Contains functionality to detect hardware virtualization (CPUID execution measurement)

Found malware configuration

Initial sample is a PE file and has a suspicious name

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Tries to detect virtualization through RDTSC time measurements

Yara detected IcedID

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/fb1484a7ccc41e954702a9bb1deb647125403a6096afb767dd8d7fbad9d13703/

Threat name:

Win64.Trojan.IcedID

Status:

Malicious

First seen:

2023-07-26 15:16:06 UTC

File Type:

PE+ (Exe)

Extracted files:

AV detection:

18 of 24 (75.00%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=7mkijj6myqpjkrycvg5r323eoesuaotas2x3oz65rv73vworg4bq._file

Verdict:

malicious

Label(s):

icedid

IcedID

1e2aaed890f3a5e5657d6806bcf6756bbdef9baeca203330ad862dcf47ddf885

IcedID

252c75237d927a1b9aeae3d4b4c04389f6c8eeccc318cdc7ae05508fed7b7b4e

IcedID

cac9f1a4a90d9f292bd7f5b33c7fedc9622e5d2921c8af41bf11ca31d0b9d92c

IcedID

fe908cbcbbdea11d0540e038a23f1a377ab0861ad5f6d013ed22dbf02b943032

IcedID

+ 146 additional samples on MalwareBazaar

Result

Malware family:

icedid

Score:

10/10

Tags:

family:icedid campaign:3297324279 banker loader trojan

Link:

https://tria.ge/reports/230726-snfy4aea71/

Behaviour

Suspicious behavior: EnumeratesProcesses

IcedID, BokBot

Malware Config

C2 Extraction:

vrondafarih.com

Unpacked files

SH256 hash:

fb1484a7ccc41e954702a9bb1deb647125403a6096afb767dd8d7fbad9d13703

MD5 hash:

c75af3a0676a5849098232dd5e1fc9b7

SHA1 hash:

ffaa8079e219cb1bc37f331ba250b4630aec8d9c

Link:

https://www.unpac.me/results/aa4756bb-df99-480f-beaa-3c1a9705ca43/

Malware family:

IcedID

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/fb1484a7ccc4/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/fb1484a7ccc41e954702a9bb1deb647125403a6096afb767dd8d7fbad9d13703

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	crime_win32_icedid_stage1 Create hunting rule
Author:	Rony (@r0ny_123)
Description:	Detects IcedID photoloader
Reference:	https://sysopfb.github.io/malware,/icedid/2020/04/28/IcedIDs-updated-photoloader.html

Rule name:	IcedIDLoader Create hunting rule
Author:	kevoreilly, threathive, enzo, r0ny123
Description:	IcedID Loader

Rule name:	IcedID_init_loader Create hunting rule
Author:	@bartblaze
Description:	Identifies IcedID (stage 1 and 2, initial loaders).

Rule name:	MALWARE_Win_IceID Create hunting rule
Author:	ditekSHen
Description:	Detects IceID / Bokbot variants

Rule name:	PE_Digital_Certificate Create hunting rule
Author:	albertzsigovits

Rule name:	Windows_Trojan_IcedID_0b62e783 Create hunting rule
Author:	Elastic Security

Rule name:	Windows_Trojan_IcedID_91562d18 Create hunting rule
Author:	Elastic Security

Rule name:	win_photoloader_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	Detects win.photoloader.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

5384074e0bb44f5fb3a9434509a1e5c2f5c2a7e7924c9e0d7c68c542fc8dd78a

IcedID

exe fb1484a7ccc41e954702a9bb1deb647125403a6096afb767dd8d7fbad9d13703

(this sample)

Link

https://tria.ge/230726-smsw9sea7v/behavioral1

Dropped by

SHA256 5384074e0bb44f5fb3a9434509a1e5c2f5c2a7e7924c9e0d7c68c542fc8dd78a

Delivery method

Distributed via e-mail attachment

Cape

https://www.capesandbox.com/analysis/434033/

Dropped by

SHA256 370e88365578673166f376e689603efdc9cff084df9f36ca3a7e96068f1e16b1

Dropped by

MD5 4b5bfea94ebec929317edec2b119cc7c

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample