bole4d.zip

General
Target

bole4d.zip

Size

207KB

Sample

220518-j1lknsacdk

Score
10 /10
MD5

f9e5c5d70977450f8b37ea17c58758cc

SHA1

3cd1a7e13460cb228d7259e5304b043b960224ba

SHA256

9fa4890001bfa61c05d4d3da5af0d2c0873b524472375ebd1e3bd66e08073421

SHA512

0d9a432d86bff724aeb22d9dea9392b5f3c8bd7d91fd438cd5dcefdd833f9fa01050d1b45fc9c51a98a2e662763568ef03968f12f8c5a565cb2df859f26b4f1d

Malware Config

Extracted

Family icedid
Campaign 3068011852
C2

yolneanz.com

Targets
Target

bole4d.dll

MD5

1c27d92924f0cdeac60ba81ec9d8b74c

Filesize

486KB

Score
3/10
SHA1

263a07d97d25ac30a5db224788fad1185a2ad3f3

SHA256

486835ad5b265b100bdbfa99a0eba9a190db33ed31fa239fa6767a8f6bd84190

SHA512

f42d2050a9d30cd9e36691f6ef94319b20eb0c44bd412dbabd3f9c2f698e68b9f5bf723123eba23ac4a2fd6ad20b7b2da67b506755769bc14b19446313c317f0

Related Tasks

Target

documents.lnk

MD5

ac16d9137f43b0f5eecde7b2b7e9b9f2

Filesize

1KB

Score
10/10
SHA1

eed21b6fcfaf9160aa1cb63c43f26747106270bd

SHA256

493c390c59258d4002ba5cb11dcdfcf322e29f657eafbae172dc9946dabb795d

SHA512

029c8fae6360dac1930a05f9236965b4ab59e95ec69cfdf86e035f3e1499229c2d46d2a0afbd40d55d7d7e2ce45c87843e9e3c1fdbdbe042ace6f0c5015f5196

Tags

Signatures

  • IcedID, BokBot

    Description

    IcedID is a banking trojan capable of stealing credentials.

    Tags

  • suricata: ET MALWARE Win32/IcedID Request Cookie

    Description

    suricata: ET MALWARE Win32/IcedID Request Cookie

    Tags

  • Blocklisted process makes network request

  • Checks computer location settings

    Description

    Looks up country code configured in the registry, likely geofence.

    TTPs

    Query RegistrySystem Information Discovery

Related Tasks

MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
          Execution
            Exfiltration
              Impact
                Initial Access
                  Lateral Movement
                    Persistence
                      Privilege Escalation
                        Tasks

                        static1

                        behavioral1

                        3/10

                        behavioral2

                        3/10