Extracted

• • Target

    Мобілізаційний список.xls.xls

  • Size

    32KB

  • MD5

    3aa6bf4ed8c485717d767013d43f7cdb

  • SHA1

    83ea9a8627819a7ba2ecad058f22e7f697256bc0

  • SHA256

    08d30d6646117cd96320447042fb3857b4f82d80a92f31ee91b16044b87929c0

  • SHA512

    db51c36533565f35b535fa4696a8992c2b1fa15cf93fb129c3ec740a394b6bff3cf43355e172c017f8ed762d99a73f2d157a0fb797cd827a228db39195652a5b

  Score

  10^/10

  icedid2493865931bankerloadersuricatatrojan

  • IcedID, BokBot

    IcedID is a banking trojan capable of stealing credentials.

    trojanbankericedid

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • suricata: ET MALWARE Win32/IcedID Request Cookie

    suricata: ET MALWARE Win32/IcedID Request Cookie

    suricata

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Loads dropped DLL

  behavioral1behavioral2