icedid | 29accd2367affb2d7dbee27caf21928490abb75f1f98742483d399f03c1aa733

General

Target

29accd2367affb2d7dbee27caf21928490abb75f1f98742483d399f03c1aa733
Size

321KB
Sample

211214-p7ba6sfga7
MD5

667fe504ea07fbde37fdd3e24226a2ab
SHA1

513e2e0df5260f029e9a027ff9a8dad9c28e0086
SHA256

29accd2367affb2d7dbee27caf21928490abb75f1f98742483d399f03c1aa733
SHA512

adfa5002aef65ddb798d2dad569702221e1aa0fd5c94f35e97e8d0acaf3b1c27dc88ef56ddb272a36be276452fb052e974920dce2a8d02a1cc7a78e07d92e396

Score

10^/10

icedid redline smokeloader 1 2 xxluchxx1 3388798547 backdoor banker discovery infostealer persistence spyware stealer trojan

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://rcacademy.at/upload/

http://e-lanpengeonline.com/upload/

http://vjcmvz.cn/upload/

http://galala.ru/upload/

http://witra.ru/upload/

rc4.i32

Extracted

Family

redline

Botnet

1

C2

195.133.47.114:38127

Extracted

Family

redline

Botnet

2

C2

194.26.229.202:18758

Extracted

Family

redline

C2

185.183.32.228:36247

Extracted

Family

redline

Botnet

xxluchxx1

C2

212.86.102.63:62907

Extracted

Family

icedid

Campaign

3388798547

C2

hipnoguard.com

Targets

- Target
  
  29accd2367affb2d7dbee27caf21928490abb75f1f98742483d399f03c1aa733
- Size
  
  321KB
- MD5
  
  667fe504ea07fbde37fdd3e24226a2ab
- SHA1
  
  513e2e0df5260f029e9a027ff9a8dad9c28e0086
- SHA256
  
  29accd2367affb2d7dbee27caf21928490abb75f1f98742483d399f03c1aa733
- SHA512
  
  adfa5002aef65ddb798d2dad569702221e1aa0fd5c94f35e97e8d0acaf3b1c27dc88ef56ddb272a36be276452fb052e974920dce2a8d02a1cc7a78e07d92e396
Score

10^/10

icedid redline smokeloader 1 2 xxluchxx1 3388798547 backdoor banker discovery infostealer persistence spyware stealer trojan
- IcedID, BokBot
  IcedID is a banking trojan capable of stealing credentials.
  trojan banker icedid
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine Payload
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Downloads MZ/PE file
- Executes dropped EXE
- Deletes itself
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1