Overview

overview

10

Static

static

core.bat

windows7_x64

10

core.bat

windows10-2004_x64

10

enrich_64.dll

windows7_x64

10

enrich_64.dll

windows10-2004_x64

10

Resubmissions

22-02-2022 16:14

220222-tpps3acabq 10

13-12-2021 19:00

211213-xn1eyseag7 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    file

  • Size

    398KB

  • Sample

    220222-tpps3acabq

  • MD5

    18a8a5edb02d117dd233e012b7405723

  • SHA1

    02d8d56c627b0fde9486bf8b49f5762763ed5f8b

  • SHA256

    6f7e4c3ffc85be11c78a5be461f00fa8b29aeb9c2948143a6c4e726fafb329ef

  • SHA512

    afdc7cc55ae667096ea7189ef56ce1c47e42cb8cdbdebbe4203ff193adaf885652508a6b8c5814e6296455d11eda94494a40cd551d15561f48d9aadca0faa5d7

Score
10/10
icedid2354879232bankertrojan

Malware Config

Extracted

Family

icedid

rsa_pubkey.plain

Extracted

Family

icedid

Botnet

2354879232

C2

gadverjo.com

hevciak.com

reseptors.com

smallbadcity.com
Attributes
  • auth_var

    13

  • url_path

    /news/

Targets

    • Target

      core.bat

    • Size

      186B

    • MD5

      d279c15418813851121062bea345b62b

    • SHA1

      82725fd7f9fd33dfdad70900b59bc4cba89e69ed

    • SHA256

      9e68480f3b53ad751ad7a0787b200864f4cd1f01a84632acad19b33666d820e8

    • SHA512

      c389803d1095b7c33bc1235804ab2b80ebada97935b38661a0535d50d35f6572c049a191eabc991e6fdb1e8655fe1d2c610db9adcb4eb83986f5b26d7e855f54

    Score
    10/10
    icedid2354879232bankertrojan

    • IcedID, BokBot

      IcedID is a banking trojan capable of stealing credentials.

      trojanbankericedid

    • Blocklisted process makes network request

    behavioral1behavioral2

    • Target

      enrich_64.tmp

    • Size

      162KB

    • MD5

      728a9cf19e753286d6fb759d3bd48e4c

    • SHA1

      3ea831ea2c999c07f26a1a8a9df6ea0a2a8365ac

    • SHA256

      074155f04abd8aaf5e3fe9853f9d5dc52704dde1e1d18ebf976f611297524dcc

    • SHA512

      20d0ced79abb88cee225730ba71599c2a84b083cb9de57cde20e6e1a8802cb92cfd443b8fb299b6515d279259e334c27f6e79e0d760983103295f576fe681364

    Score
    10/10
    icedid2354879232bankertrojan

    • IcedID, BokBot

      IcedID is a banking trojan capable of stealing credentials.

      trojanbankericedid
    behavioral3behavioral4

MITRE ATT&CK Matrix

Tasks