Overview

overview

10

Static

static

youTube.hta

windows7_x64

10

youTube.hta

windows10_x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    youTube.hta

  • Size

    3KB

  • Sample

    211201-xy925sach2

  • MD5

    55d9eab53d4063a53b6ed05f7b1e75e7

  • SHA1

    e6b4c81676d3ef0d2f7d08a6cc2ad90eb54908c3

  • SHA256

    c7f40608ce8a3dda25c13d117790d08ef757b07b8c2ccb645a27a71adc322fb2

  • SHA512

    e90768d87c7b191d41d3944957725db0e1f29fa865e24fd7308656fc9249ca0a5d1bd0abeda3bbc68528efc0ce6bc3a79eb434c375fd5c6ec90455c6e19a74f9

Score
10/10
icedid1892568649bankertrojan

Malware Config

Extracted

Family

icedid

Campaign

1892568649

C2

normyils.com

Targets

    • Target

      youTube.hta

    • Size

      3KB

    • MD5

      55d9eab53d4063a53b6ed05f7b1e75e7

    • SHA1

      e6b4c81676d3ef0d2f7d08a6cc2ad90eb54908c3

    • SHA256

      c7f40608ce8a3dda25c13d117790d08ef757b07b8c2ccb645a27a71adc322fb2

    • SHA512

      e90768d87c7b191d41d3944957725db0e1f29fa865e24fd7308656fc9249ca0a5d1bd0abeda3bbc68528efc0ce6bc3a79eb434c375fd5c6ec90455c6e19a74f9

    Score
    10/10
    icedid1892568649bankertrojan

    • IcedID, BokBot

      IcedID is a banking trojan capable of stealing credentials.

      trojanbankericedid

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks