Extracted

Extracted

Extracted

• • Target

    E7A7032DDAE1ADFD64C4C378C6E97BE7A2453228C7014.exe

  • Size

    285KB

  • MD5

    8bce39cd73af077e8a24360ad94cd368

  • SHA1

    f761251b872215b0d34b76a53dd6b1452c6ca255

  • SHA256

    e7a7032ddae1adfd64c4c378c6e97be7a2453228c7014a21d3945fc3ddc85d75

  • SHA512

    5c3d9be970deef5ea27c11758656512b49533cdbaeae432569f442c7f30c4c054c313e283b09aea282de7d93a09af143293592221014784c337626250a7b81a0

  Score

  10^/10

  icedidsmokeloader1843818144backdoorbankerloadersuricatatrojanraccoon9185b8c5d1dac158cc47aef92b143671d2c3a9bfstealer

  • IcedID, BokBot

    IcedID is a banking trojan capable of stealing credentials.

    trojanbankericedid

  • Raccoon

    Simple but powerful infostealer which was very active in 2019.

    stealerraccoon

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Suspicious use of NtCreateProcessExOtherParentProcess

  • suricata: ET MALWARE JS/Nemucod requesting EXE payload 2016-02-01

    suricata: ET MALWARE JS/Nemucod requesting EXE payload 2016-02-01

    suricata

  • suricata: ET MALWARE JS/Nemucod.M.gen downloading EXE payload

    suricata: ET MALWARE JS/Nemucod.M.gen downloading EXE payload

    suricata

  • suricata: ET MALWARE Win32.Raccoon Stealer - Telegram Mirror Checkin (generic)

    suricata: ET MALWARE Win32.Raccoon Stealer - Telegram Mirror Checkin (generic)

    suricata

  • suricata: ET MALWARE Win32/IcedID Request Cookie

    suricata: ET MALWARE Win32/IcedID Request Cookie

    suricata

  • IcedID First Stage Loader

    loader

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Deletes itself

  • Loads dropped DLL

  behavioral1behavioral2