Overview

overview

10

Static

static

core.bat

windows7_x64

10

core.bat

windows10-2004_x64

10

winkx64.dll

windows7_x64

10

winkx64.dll

windows10-2004_x64

10

Resubmissions

22-02-2022 16:13

220222-tpjbaacabk 10

14-12-2021 18:58

211214-xmqjcsgcb9 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    file

  • Size

    578KB

  • Sample

    220222-tpjbaacabk

  • MD5

    e8522c5af19251381b6d383330173f73

  • SHA1

    ab68c5ef8d9d0f2ccd49a15a5d2f3808dd309f76

  • SHA256

    663d90c8fd825d445dfa80bd92bd33ae5b19a44788ff3996762f48a9e783ba6c

  • SHA512

    1c639b308bf55f42c6b706bebc49defd2fae19ebee739c6b534f7b70504d78200b1b692763deb76f01f186e1f9750e112d14fa87b40d5e7df98270b532a3c3e5

Score
10/10
icedid3494996616bankertrojan

Malware Config

Extracted

Family

icedid

rsa_pubkey.plain

Extracted

Family

icedid

Botnet

3494996616

C2

holniakea.com

lhaerty.com

grandtexen.com

flourmat.com
Attributes
  • auth_var

    13

  • url_path

    /news/

Targets

    • Target

      core.bat

    • Size

      182B

    • MD5

      8f83ce721517e2f12a86ac5ced66d1f2

    • SHA1

      ca212f7c0f76adad3d4827d477eba6f7fbe74466

    • SHA256

      bd35badac2604c62981ae658096799944713cddc7b1770cfc9da8cfa73b1908e

    • SHA512

      13a4e534d2e6b3927516a32524dcad4ce07f580ac8819b6567158dacf50c0f1a1c3136b6c7c56031eb16991467c8c61b9334c7a987a7bac144181f98dad07e6c

    Score
    10/10
    icedid3494996616bankertrojan

    • IcedID, BokBot

      IcedID is a banking trojan capable of stealing credentials.

      trojanbankericedid

    • Blocklisted process makes network request

    behavioral1behavioral2

    • Target

      winkx64.dat

    • Size

      511KB

    • MD5

      ee8c568d054c55f49ede1a36b54c5744

    • SHA1

      3021748cefea0c24ca1f40038ca7a02ae69f9c9a

    • SHA256

      93676744987176413c480f4f4af9a7f3d2daeee84983f53bc49967dadd9a4dcd

    • SHA512

      1c39954f7e2300bc04eadf74c455f611b4081015f1c6c0cf74f5b2a3f01cf41579c0215ea33dde4315a4cc33bf21b882afa8806566137f8b14e690045a9fe1b2

    Score
    10/10
    icedid3494996616bankertrojan

    • IcedID, BokBot

      IcedID is a banking trojan capable of stealing credentials.

      trojanbankericedid
    behavioral3behavioral4

MITRE ATT&CK Matrix

Tasks