Extracted

Extracted

• • Target

    bd2faaa3e1211c9a88db69a5265b03e1.exe

  • Size

    271KB

  • MD5

    bd2faaa3e1211c9a88db69a5265b03e1

  • SHA1

    849b918144f5fda0226921a2b5bbaa0176662111

  • SHA256

    93c049876b916ec5034d9884338be59b11bce8a74f4d0bea329a3ed028c41b88

  • SHA512

    56c5beff62a02da78b93102411fb8ff77897b3e12d08cc52d3b6b37bfc15a882e32c0822539ab8b4a1b7e4a08d4d196cf5d289670c19183878f9d4ac1d43c298

  Score

  10^/10

  icedidsmokeloader1843818144backdoorbankerloadertrojanevasion

  • IcedID, BokBot

    IcedID is a banking trojan capable of stealing credentials.

    trojanbankericedid

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Suspicious use of NtCreateProcessExOtherParentProcess

  • IcedID First Stage Loader

    loader

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Modifies Windows Firewall

    evasion

  • Deletes itself

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2