MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fe47d6df1dbba98481434048616e085c98555a8537964636aa54e9f30a8e38a5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


IcedID


Vendor detections: 5


Intelligence 5 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: fe47d6df1dbba98481434048616e085c98555a8537964636aa54e9f30a8e38a5
SHA3-384 hash: 58ad52645f14f85c25dfa49f44832ee8cdeb61458478a6a2fe87f5906396ad4e815f9c4ed32f45c8841d78bfe8e90966
SHA1 hash: e67e338931562368cd9cdf66d245e644c7bd1105
MD5 hash: 7f8be741578286671c8367d9d3070e76
humanhash: eight-monkey-seventeen-yellow
File name:fe47d6df1dbba98481434048616e085c98555a8537964636aa54e9f30a8e38a5
Download: download sample
Signature IcedID
Create hunting rule
File size:146'432 bytes
First seen:2020-11-11 11:44:01 UTC
Last seen:2020-11-11 13:52:31 UTC
File type:DLL dll
MIME type:application/x-dosexec
imphash 3097b1c5bba2e716be269c55c1f71681 (9 x IcedID)
ssdeep 3072:pv+EcWpciTRV6pgFD/P0Jtfy+u8L3lhiJo7A:pv+zWWq8puQzKSq8A
TLSH B3E39E023290D076E9B742319864DF91577ABDA15F718E9733C46A4FAD322D08F36BA3
Reporter seifreed
Tags:IcedID

Intelligence

File Origin
# of uploads :
2
# of downloads :
141
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Variant.Zusy.334847.789.24786.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
64 / 100
Link:
https://www.joesandbox.com/analysis/531669
Signature
Contains functionality to detect hardware virtualization (CPUID execution measurement)
Multi AV Scanner detection for submitted file
System process connects to network (likely due to code injection or exploit)
Tries to detect virtualization through RDTSC time measurements
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/fe47d6df1dbba98481434048616e085c98555a8537964636aa54e9f30a8e38a5/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-11-11 11:55:05 UTC
AV detection:
22 of 29 (75.86%)
Threat level:
  5/5
Verdict:
unknown
Result
Malware family:
icedid
Create hunting rule
Score:
  10/10
Tags:
family:icedid banker trojan
Link:
https://tria.ge/reports/201111-ed69bs57rs/
Behaviour
Suspicious use of WriteProcessMemory
Suspicious behavior: EnumeratesProcesses
Blacklisted process makes network request
IcedID Core Payload
IcedID, BokBot
Unpacked files
SH256 hash:
fe47d6df1dbba98481434048616e085c98555a8537964636aa54e9f30a8e38a5
MD5 hash:
7f8be741578286671c8367d9d3070e76
SHA1 hash:
e67e338931562368cd9cdf66d245e644c7bd1105
Link:
https://www.unpac.me/results/96eaf4a1-9a61-4486-ae50-431f5b564091/
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:crime_win32_banker_iceid_ldr1
Create hunting rule
Author:@VK_Intel
Description:Detects IcedId/BokBot png loader (unpacked)
Reference:twitter

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other

Comments