Overview

overview

10

Static

static

core/cmd.bat

windows7_x64

10

core/cmd.bat

windows10-2004_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    core.zip
  • Size 685KB
  • Sample220218-vsggjacga7
  • SHA256 e903d91fbb20cdc5aa801a6e8e6908c3d5611afb7415942a5b15f2c6871afceb
  • MD5 SHA1 SHA512
Score
10/10
icedid3560182600bankercollectionspywarestealertrojan

Malware Config

Extracted

Family

  • icedid

rsa_pubkey.plain

Extracted

Family

  • icedid

Botnet

  • 3560182600

C2

  • coolbearblunts.com

  • cooldogblunts.com

Attributes
  • auth_var

    2

  • url_path

    /news/

Targets

    • Target
      core/cmd.bat
    • Size 190B
    • SHA256 663f8c98f7866d7150385adec8725544d8b95481b6e04a040cf8ff93d5eef50c
    • MD5 SHA1 SHA512
    Score
    10/10
    icedid3560182600bankertrojancollectionspywarestealer

    • IcedID, BokBot

      IcedID is a banking trojan capable of stealing credentials.

      trojanbankericedid

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks