Overview

overview

10

Static

static

6295c6b8ed173.dll

windows7_x64

10

6295c6b8ed173.dll

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    6295c6b8ed173.dll

  • Size

    480KB

  • Sample

    220531-jk595safh4

  • MD5

    fb52f6baf931b68def54efe08733bbff

  • SHA1

    4a27c3368a742b39765a8ce755fb0f1e00d1c0b5

  • SHA256

    344b6a7c3888aed4239480b4b79381bdf995e0ab8103f982912d1b769d2a8ec2

  • SHA512

    4f9d81572b7c72a59a77975e6b8877217b5684a2fd6c66fc51935b4b0e55690cad66e60d9d2d864c5ff02a86935c86878524a154f89f58d90142101b76f52230

Score
10/10
icedid2581925242bankerloadersuricatatrojan

Malware Config

Extracted

Family

icedid

Campaign

2581925242

C2

uleoballs.com

Targets

    • Target

      6295c6b8ed173.dll

    • Size

      480KB

    • MD5

      fb52f6baf931b68def54efe08733bbff

    • SHA1

      4a27c3368a742b39765a8ce755fb0f1e00d1c0b5

    • SHA256

      344b6a7c3888aed4239480b4b79381bdf995e0ab8103f982912d1b769d2a8ec2

    • SHA512

      4f9d81572b7c72a59a77975e6b8877217b5684a2fd6c66fc51935b4b0e55690cad66e60d9d2d864c5ff02a86935c86878524a154f89f58d90142101b76f52230

    Score
    10/10
    icedid2581925242bankerloadersuricatatrojan

    • IcedID, BokBot

      IcedID is a banking trojan capable of stealing credentials.

      trojanbankericedid

    • suricata: ET MALWARE Win32/IcedID Request Cookie

      suricata: ET MALWARE Win32/IcedID Request Cookie

      suricata

    • Blocklisted process makes network request

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks