Overview

overview

10

Static

static

Fri0541e16...8f.exe

windows7_x64

10

Fri0541e16...8f.exe

windows7_x64

10

Fri0541e16...8f.exe

windows7_x64

10

Fri0541e16...8f.exe

windows11_x64

10

Fri0541e16...8f.exe

windows10_x64

10

Fri0541e16...8f.exe

windows10_x64

10

Fri0541e16...8f.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Fri0541e16ce794d258f.exe

  • Size

    284KB

  • Sample

    211022-rz4c4abgc2

  • MD5

    dec69c757ce1ae8454f97ef6966aa817

  • SHA1

    160d556701a012ab18194aeecaa396e21727c9b2

  • SHA256

    2b396ae1fa95ef655bb7b0eb45532a857d882bb601adeb8fb1b5d43dcff9ec31

  • SHA512

    c6304aa1a5b762804c81461fb1db1bae9ba57120c279dfb1ad83c3bb2e3309563f15c90a1a04a9f3acb5aac3a527432a87d1bb7ba32846dc75bda961b162db16

Score
10/10
icedidsmokeloader1875681804backdoorbankerpersistencetrojan

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://directorycart.com/upload/

http://tierzahnarzt.at/upload/

http://streetofcards.com/upload/

http://ycdfzd.com/upload/

http://successcoachceo.com/upload/

http://uhvu.cn/upload/

http://japanarticle.com/upload/
rc4.i32
rc4.i32

Extracted

Family

icedid

Campaign

1875681804

C2

enticationmetho.ink

Targets

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Install Root Certificate

1
T1130

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

3
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

3
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks