Overview

overview

10

Static

static

core/velvet64.tmp.dll

windows7_x64

10

core/velvet64.tmp.dll

windows10_x64

10

core/cmd.bat

windows7_x64

10

core/cmd.bat

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    core.zip

  • Size

    386KB

  • Sample

    211102-tgkjdahcep

  • MD5

    ae05618e780c3e801f72c959eb08f5b3

  • SHA1

    4da509fec5c750be818d5f56823cc9ce97d8511b

  • SHA256

    9d48b369cb91308152f2fae86f2427927b31b2e43c01fac4b6c67afb84230ca2

  • SHA512

    99c61b1b9b555c5cbe67e89ec0e5549d30f4b11ec5aca581bb20e24f23c6b8b350fba733a61a4b78f3869875b87f244d4f2246d37f75117dad69b4d7401c322e

Score
10/10
icedid1217670233bankercollectionspywarestealertrojan

Malware Config

Extracted

Family

icedid

Botnet

1217670233

C2

nnelforwfin.top

lakogrefop.rest

hangetilin.top

thoutilin.fun
Attributes
  • auth_var

    10

  • url_path

    /posts/

Extracted

Family

icedid

rsa_pubkey.plain

Targets

    • Target

      core/cmd.bat

    • Size

      191B

    • MD5

      4a8ffc3ba4fa995c640c9d06b1a6c573

    • SHA1

      7d8325bf529ebb590a11f214dd540b7e6148ec8c

    • SHA256

      923aab6bd68d5961f0edb31ab5782c57691e5b71f655055f0f59a396300a5bbd

    • SHA512

      c1169313ea7bacc38360d351b4e84883d44f340adff5484a5317c1eb36ddd4284e6909eebc03dd3adb394f26f075768f507b6e2a1913b01ce60a4f7a86712b78

    Score
    10/10
    icedid1217670233bankertrojan

    • IcedID, BokBot

      IcedID is a banking trojan capable of stealing credentials.

      trojanbankericedid
    behavioral1behavioral2

    • Target

      core/velvet64.tmp

    • Size

      167KB

    • MD5

      2a5bf472934cc6d25aa80dc06ddec260

    • SHA1

      d11a99f060ca4cc2a5495a4a9e00cad08065b44b

    • SHA256

      acc606cc23252d3a25e443ddff518362e936d1903bb0f3df36c7a95fef976a46

    • SHA512

      b6e1f46d93174608ec12cf7909e67555eb24823c653600d3d91d20177d67f1c49f2eef1494e8989c9d0a76fbe25f06ca8b691812ee278d186ab729ea9cd4bc63

    Score
    10/10
    icedid1217670233bankertrojancollectionspywarestealer

    • IcedID, BokBot

      IcedID is a banking trojan capable of stealing credentials.

      trojanbankericedid

    • Blocklisted process makes network request

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection
    behavioral3behavioral4

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Command-Line Interface

1
T1059

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1
T1081

Discovery

System Information Discovery

3
T1082

Remote System Discovery

1
T1018

Lateral Movement

Collection

Data from Local System

1
T1005

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Tasks