Description
IcedID is a banking trojan capable of stealing credentials.
StolenImg.rar
General
Target
Size
Sample
StolenImg.rar
321KB
220510-scw6yahcf5
Score
10 /10
MD5
SHA1
SHA256
SHA512
c8eefbc5e111b1fb7da5ca1e2a80a59e
ec085dd85a9a2c075f05437318f9d57b30e97d51
e843f357788c17351b569fd3ff32cdb91fe498eec76c0397e6c0fcfd978edb53
4bee11ba7c1fb1829e59c598d47bb8f15796440cfb117fc5d87e99434edddf54a6b6a89e3325a906acc5a7976a053f2269c275bf374c1e6c4e885a5d197b63d4
Malware Config
Extracted
| Family | icedid |
| Campaign | 3000901376 |
| C2 |
yolneanz.com |
Targets
Target
MD5
Filesize
documents.lnk
dc097dea18775a8f3d31b52697dc368e
1KB
Score
10/10
SHA1
SHA256
SHA512
c9d5fe30ac230dc48d450182fb899c9638fb35bb
f7861ee8b3917e3746d44a769453334c9bf1b780213634ed9abd42f7873b0593
ad34d919b7e8dc014e53c14a3a6c74556a24b1258aec83eb3c5fe584c9c908ba3a11e001319ae22e51173c6908ba6c34e5dde7f4056d0cc753e645ea2310ddb0
Tags
Signatures
-
IcedID, BokBot
-
suricata: ET MALWARE Win32/IcedID Request Cookie
Description
suricata: ET MALWARE Win32/IcedID Request Cookie
Tags
-
Blocklisted process makes network request
-
Checks computer location settings
Description
Looks up country code configured in the registry, likely geofence.
TTPs
Related Tasks
Target
MD5
Filesize
olasius.dll
2d01a326dcb38cd629b771e35ad3f5d5
576KB
Score
3/10
SHA1
SHA256
SHA512
111af3037c9837e8fb43610e070af474bd9bcbea
6c168f840b0af92cc2974a95151d3b21f02c37be9d16225bac03ece6c1404369
a3fd2c640a6a478796e06ca88a2b5752ed37ccbae9c419488ccbdef8c344c4379becd2e3d1beda1f3bab4d3b943917a9b23d9e3fea5bb6d3148b0904b8996a76
Related Tasks
MITRE ATT&CK Matrix
Collection
Command and Control
Credential Access
Defense Evasion
Execution
Exfiltration
Impact
Initial Access
Lateral Movement
Persistence
Privilege Escalation
Tasks