icedid | 7ba745d20db94b41924bd88906cbc2e813c95c586232b5659ad0679a3cac2813

General

Target

win_setup__6218604fb60ef.exe
Size

5.8MB
Sample

220225-jh25psfdg2
MD5

a5ede982bb74d31f5990bf77046bdd92
SHA1

c468057a1c7d45fcda77b3a2d73d66097cab3761
SHA256

7ba745d20db94b41924bd88906cbc2e813c95c586232b5659ad0679a3cac2813
SHA512

9639939f450647c6faaa2f1639d49aeccd367a4d97a40326ae75823901bb230dcd53bb37e95b99fa92868150219558f869751b0699fa9df89d2394cfe3bf0d7b

Score

10^/10

Malware Config

Extracted

Family

socelars

C2

https://frertge.s3.eu-west-2.amazonaws.com/asdhbf/

Extracted

Family

smokeloader

Version

2020

C2

http://host-data-coin-11.com/

http://file-coin-host-12.com/

http://pjure.at/upload/

http://puffersweiven.com/upload/

http://algrcabel.ru/upload/

http://pelangiqq99.com/upload/

http://elsaunny.com/upload/

http://korphoto.com/upload/

http://hangxachtaythodoan.com/upload/

http://pkodev.net/upload/

http://go-piratia.ru/upload/

http://piratia.su/upload/

rc4.i32

Extracted

Family

redline

Botnet

media24222

C2

92.255.57.154:11841

Attributes

auth_value
f890639129cd300e1030ac8f7cfc1f24

Extracted

Family

icedid

Campaign

2715004312

Targets

- Target
  
  win_setup__6218604fb60ef.exe
- Size
  
  5.8MB
- MD5
  
  a5ede982bb74d31f5990bf77046bdd92
- SHA1
  
  c468057a1c7d45fcda77b3a2d73d66097cab3761
- SHA256
  
  7ba745d20db94b41924bd88906cbc2e813c95c586232b5659ad0679a3cac2813
- SHA512
  
  9639939f450647c6faaa2f1639d49aeccd367a4d97a40326ae75823901bb230dcd53bb37e95b99fa92868150219558f869751b0699fa9df89d2394cfe3bf0d7b
Score

10^/10

onlylogger redline smokeloader socelars media24222 aspackv2 backdoor discovery infostealer loader persistence spyware stealer trojan icedid 2715004312 banker upx
- IcedID, BokBot
  IcedID is a banking trojan capable of stealing credentials.
  trojan banker icedid
- OnlyLogger
  A tiny loader that uses IPLogger to get its payload.
  loader onlylogger
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine Payload
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Socelars
  Socelars is an infostealer targeting browser cookies and credit card credentials.
  stealer socelars
- Socelars Payload
- Suspicious use of NtCreateProcessExOtherParentProcess
- Suspicious use of NtCreateUserProcessOtherParentProcess
- OnlyLogger Payload
- ASPack v2.12-2.42
  Detects executables packed with ASPack v2.12-2.42
  aspackv2
- Blocklisted process makes network request
- Downloads MZ/PE file
- Drops file in Drivers directory
- Executes dropped EXE
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral1 behavioral2