Extracted

Extracted

Extracted

• • Target

    54267-876-8676.lnk

  • Size

    2KB

  • MD5

    9edabe11d846a6de5d337e737d24e85c

  • SHA1

    26f63aac40c4e9f459a379eec94a258b604f582e

  • SHA256

    4b582f38e3376346cb066e36ff8dfa32b268154bb2de13870702e8bbf366a023

  • SHA512

    5e88d418cb26f4bfd7bf5d1b2dbf31a8f026bbf29c760919d2986c883de6067df75c5eb8ca790a2c4a7ef09b87a2c6ba1b62e57e76fc3b32af633317639c6f0e

  Score

  10^/10

  icedid109932505bankerloaderpersistencesuricatatrojan

  • IcedID, BokBot

    IcedID is a banking trojan capable of stealing credentials.

    trojanbankericedid

  • suricata: ET MALWARE Win32/IcedID Request Cookie

    suricata: ET MALWARE Win32/IcedID Request Cookie

    suricata

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2