Overview

overview

10

Static

static

core.bat

windows7_x64

10

core.bat

windows10_x64

10

group_32.tmp.dll

windows7_x64

10

group_32.tmp.dll

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    file
  • Size 380KB
  • Sample211124-vln8ssgdf6
  • SHA256 fbe3fc4926ed67359b39778cbc6c39f681d859bb21d64028d5f86cbc7ad14811
  • MD5 SHA1 SHA512
Score
10/10
icedid2237127122bankertrojan

Malware Config

Extracted

Family

  • icedid

rsa_pubkey.plain

Extracted

Family

  • icedid

Botnet

  • 2237127122

C2

  • lokidasterreno.site

  • burgomustopr.rest

  • lopityr4.pw

  • rocesdilin.top

Attributes
  • auth_var

    6

  • url_path

    /posts/

Targets

    • Target
      core.bat
    • Size 184B
    • SHA256 550b39c60eca29760f353e42deffac5f8c7dcfd5b9f44132ba2ed29f6d0293f8
    • MD5 SHA1 SHA512
    Score
    10/10
    icedid2237127122bankertrojan

    • IcedID, BokBot

      IcedID is a banking trojan capable of stealing credentials.

      trojanbankericedid

    • Blocklisted process makes network request

    behavioral1behavioral2
    • Target
      group_32.tmp
    • Size 64KB
    • SHA256 7c8185c7f9fa5f7b2e402fbf5831fde7fa1c23fda6684472d137ebacf6888571
    • MD5 SHA1 SHA512
    Score
    10/10
    icedid2237127122bankertrojan

    • IcedID, BokBot

      IcedID is a banking trojan capable of stealing credentials.

      trojanbankericedid
    behavioral3behavioral4

MITRE ATT&CK Matrix

Tasks