Overview

overview

10

Static

static

bole4d.dll

windows7_x64

3

bole4d.dll

windows10-2004_x64

3

documents.lnk

windows7_x64

10

documents.lnk

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    bole4d.zip

  • Size

    207KB

  • Sample

    220518-j1lknsacdk

  • MD5

    f9e5c5d70977450f8b37ea17c58758cc

  • SHA1

    3cd1a7e13460cb228d7259e5304b043b960224ba

  • SHA256

    9fa4890001bfa61c05d4d3da5af0d2c0873b524472375ebd1e3bd66e08073421

  • SHA512

    0d9a432d86bff724aeb22d9dea9392b5f3c8bd7d91fd438cd5dcefdd833f9fa01050d1b45fc9c51a98a2e662763568ef03968f12f8c5a565cb2df859f26b4f1d

Score
10/10
icedid3068011852bankerloadersuricatatrojan

Malware Config

Extracted

Family

icedid
Campaign

3068011852
C2

yolneanz.com

Targets

    • Target

      bole4d.dll

    • Size

      486KB

    • MD5

      1c27d92924f0cdeac60ba81ec9d8b74c

    • SHA1

      263a07d97d25ac30a5db224788fad1185a2ad3f3

    • SHA256

      486835ad5b265b100bdbfa99a0eba9a190db33ed31fa239fa6767a8f6bd84190

    • SHA512

      f42d2050a9d30cd9e36691f6ef94319b20eb0c44bd412dbabd3f9c2f698e68b9f5bf723123eba23ac4a2fd6ad20b7b2da67b506755769bc14b19446313c317f0

    Score
    3/10
    behavioral1behavioral2

    • Target

      documents.lnk

    • Size

      1KB

    • MD5

      ac16d9137f43b0f5eecde7b2b7e9b9f2

    • SHA1

      eed21b6fcfaf9160aa1cb63c43f26747106270bd

    • SHA256

      493c390c59258d4002ba5cb11dcdfcf322e29f657eafbae172dc9946dabb795d

    • SHA512

      029c8fae6360dac1930a05f9236965b4ab59e95ec69cfdf86e035f3e1499229c2d46d2a0afbd40d55d7d7e2ce45c87843e9e3c1fdbdbe042ace6f0c5015f5196

    Score
    10/10
    icedid3068011852bankerloadersuricatatrojan

    • IcedID, BokBot

      IcedID is a banking trojan capable of stealing credentials.

      trojanbankericedid

    • suricata: ET MALWARE Win32/IcedID Request Cookie

      suricata: ET MALWARE Win32/IcedID Request Cookie

      suricata

    • Blocklisted process makes network request

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    behavioral3behavioral4

MITRE ATT&CK Matrix

Collection

    Command and Control

      Credential Access

        Defense Evasion

          Discovery

          Execution

            Exfiltration

              Impact

                Initial Access

                  Lateral Movement

                    Persistence

                      Privilege Escalation