icedid | 8d5b572415a417017f3cac4151ee47381999a7826c09553160512310314aec68

General

Target

ade97ee2d8365bac817b0ce3c933cd8d.exe
Size

408KB
Sample

211022-xdjpfscac8
MD5

ade97ee2d8365bac817b0ce3c933cd8d
SHA1

3c01c46b6f14a5e752b78c7bd7916cfea7cb81ef
SHA256

8d5b572415a417017f3cac4151ee47381999a7826c09553160512310314aec68
SHA512

77e5d1c56ce91c9650b6c5aa70b7d887214aa4a5228fbc31a283ea6f2900dbdbfa4e84dcd5051f58023f4e369dbe0050c23970daf7ea284ae0d9d72910706d13

Score

10^/10

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://directorycart.com/upload/

http://tierzahnarzt.at/upload/

http://streetofcards.com/upload/

http://ycdfzd.com/upload/

http://successcoachceo.com/upload/

http://uhvu.cn/upload/

http://japanarticle.com/upload/

rc4.i32

Extracted

Family

icedid

Campaign

1875681804

C2

enticationmetho.ink

Extracted

Family

vidar

Version

41.5

Botnet

936

C2

https://mas.to/@xeroxxx

Attributes

profile_id
936

Targets

- Target
  
  ade97ee2d8365bac817b0ce3c933cd8d.exe
- Size
  
  408KB
- MD5
  
  ade97ee2d8365bac817b0ce3c933cd8d
- SHA1
  
  3c01c46b6f14a5e752b78c7bd7916cfea7cb81ef
- SHA256
  
  8d5b572415a417017f3cac4151ee47381999a7826c09553160512310314aec68
- SHA512
  
  77e5d1c56ce91c9650b6c5aa70b7d887214aa4a5228fbc31a283ea6f2900dbdbfa4e84dcd5051f58023f4e369dbe0050c23970daf7ea284ae0d9d72910706d13
Score

10^/10

smokeloader backdoor trojan upx icedid vidar 936 1875681804 banker discovery spyware stealer
- IcedID, BokBot
  IcedID is a banking trojan capable of stealing credentials.
  trojan banker icedid
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Vidar
  Vidar is an infostealer based on Arkei stealer.
  stealer vidar
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Vidar Stealer
  stealer
- Downloads MZ/PE file
- Executes dropped EXE
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Deletes itself
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses 2FA software files, possible credential harvesting
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Legitimate hosting services abused for malware hosting/C2
behavioral1 behavioral2