Description
IcedID is a banking trojan capable of stealing credentials.
bole4d.zip
General
Target
Size
Sample
bole4d.zip
207KB
220518-j1lknsacdk
Score
10 /10
MD5
SHA1
SHA256
SHA512
f9e5c5d70977450f8b37ea17c58758cc
3cd1a7e13460cb228d7259e5304b043b960224ba
9fa4890001bfa61c05d4d3da5af0d2c0873b524472375ebd1e3bd66e08073421
0d9a432d86bff724aeb22d9dea9392b5f3c8bd7d91fd438cd5dcefdd833f9fa01050d1b45fc9c51a98a2e662763568ef03968f12f8c5a565cb2df859f26b4f1d
Malware Config
Extracted
| Family | icedid |
| Campaign | 3068011852 |
| C2 |
yolneanz.com |
Targets
Target
MD5
Filesize
bole4d.dll
1c27d92924f0cdeac60ba81ec9d8b74c
486KB
Score
3/10
SHA1
SHA256
SHA512
263a07d97d25ac30a5db224788fad1185a2ad3f3
486835ad5b265b100bdbfa99a0eba9a190db33ed31fa239fa6767a8f6bd84190
f42d2050a9d30cd9e36691f6ef94319b20eb0c44bd412dbabd3f9c2f698e68b9f5bf723123eba23ac4a2fd6ad20b7b2da67b506755769bc14b19446313c317f0
Related Tasks
Target
MD5
Filesize
documents.lnk
ac16d9137f43b0f5eecde7b2b7e9b9f2
1KB
Score
10/10
SHA1
SHA256
SHA512
eed21b6fcfaf9160aa1cb63c43f26747106270bd
493c390c59258d4002ba5cb11dcdfcf322e29f657eafbae172dc9946dabb795d
029c8fae6360dac1930a05f9236965b4ab59e95ec69cfdf86e035f3e1499229c2d46d2a0afbd40d55d7d7e2ce45c87843e9e3c1fdbdbe042ace6f0c5015f5196
Tags
Signatures
-
IcedID, BokBot
-
suricata: ET MALWARE Win32/IcedID Request Cookie
Description
suricata: ET MALWARE Win32/IcedID Request Cookie
Tags
-
Blocklisted process makes network request
-
Checks computer location settings
Description
Looks up country code configured in the registry, likely geofence.
TTPs
Related Tasks
MITRE ATT&CK Matrix
Collection
Command and Control
Credential Access
Defense Evasion
Execution
Exfiltration
Impact
Initial Access
Lateral Movement
Persistence
Privilege Escalation
Tasks