Extracted

Extracted

Extracted

• • Target

    Invoice_1.lnk

  • Size

    2KB

  • MD5

    c00c67f3de031c5ae198ba0362b5dd01

  • SHA1

    40f3b0263f8fccdf1fd5fe287dbd55829a8eddd6

  • SHA256

    d146c8bc52ec74b67704b30c0fb20995ba65770d191502f70c88c262dc44fc5d

  • SHA512

    4944aa5947667500eddb4d7fed5b0a8eb4d14db1d60496fcbe38c4032511b04c92757807a23dff49353f5ee75a5ed44cc5de9ed7cdcd12b59a7b8c9214e227ad

  Score

  10^/10

  icedid109932505bankerevasionloadersuricatatrojan

  • IcedID, BokBot

    IcedID is a banking trojan capable of stealing credentials.

    trojanbankericedid

  • UAC bypass

    evasiontrojan

  • suricata: ET MALWARE Win32/IcedID Request Cookie

    suricata: ET MALWARE Win32/IcedID Request Cookie

    suricata

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  behavioral1behavioral2