Overview

overview

10

Static

static

reconstruc...md.bat

windows7_x64

1

reconstruc...md.bat

windows10-2004_x64

1

reconstruc...r-.dll

windows7_x64

10

reconstruc...r-.dll

windows10-2004_x64

10

reconstruc...se.dat

windows7_x64

3

reconstruc...se.dat

windows10-2004_x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    core.zip

  • Size

    799KB

  • Sample

    220604-qd3c8sgeg8

  • MD5

    aa68ee8783a0db25efdf7b01c8e4b754

  • SHA1

    826fd413bcb6899f378c99bbd901f727e8fbc27a

  • SHA256

    c6021e59df4ef15a6590e4cc4b5d2a75c7c881397f154163849f969ebfbf8933

  • SHA512

    8eff2d2c4efab1fc946a7520fc5695d46640fe33ad1209138d89ca4b5c58d099808f04b2c25bc988c007267c6cb893c06fdf3c7328b27a1502d25f1eda40fd99

Score
10/10
icedid3681413287bankercore_loadertrojan

Malware Config

Extracted

Family

icedid

Botnet

3681413287

C2

vadgeatemoz.com

akernilon.com

westdudil.com

leatyeals.com
Attributes
  • auth_var

    3

  • url_path

    /news/

Targets

    • Target

      reconstructed_core/2022-06-04/core/cmd.bat

    • Size

      188B

    • MD5

      d67f758395e66ed03d9065d8c23f2894

    • SHA1

      1d635b99201ef4551132d29495e0c259404bd5eb

    • SHA256

      afc903fcce880470df94d38d1f877c114c16ba78d2a25a0b9094c99e425f3586

    • SHA512

      d48a6f81dc69bf0b9024e775c8620c504f1563e57978213635e3ebd546c450a3e8c621ba58d1dc1d1c2f71b4563ff8c7abd0915255874a59bfb4917c2cb2ff5f

    Score
    1/10
    behavioral1behavioral2

    • Target

      reconstructed_core/2022-06-04/core/labor-.tmp

    • Size

      464KB

    • MD5

      6dff622395b320b2a1947480d697d3c0

    • SHA1

      b2d90b643749b06d6ae98e71205cab2e67bc1d56

    • SHA256

      82e07bd3ecada519802984139c213db4332bbc49b61509a6b40b7142c28f4900

    • SHA512

      59be37e0dfd5fef04763a51e449265a25176401a58b35b7b28016e99a6860437ed8985b0ffb14182eb8df2c61943a54a0bbab38466d67946ef652b5d107ded11

    Score
    10/10
    icedid3681413287bankercore_loadertrojan

    • IcedID, BokBot

      IcedID is a banking trojan capable of stealing credentials.

      trojanbankericedid
    behavioral3behavioral4

    • Target

      reconstructed_core/2022-06-04/core/license.dat

    • Size

      334KB

    • MD5

      c3db0f946699412e8f3a2775516116a2

    • SHA1

      a01448e2760dcb2fbed70a634baaae559d3b6de0

    • SHA256

      dbe9743c9c57247cb9275a23a84909dd78aca59f584df62197bde07cb87bd1ed

    • SHA512

      50b2e9b3446463f4b02980587b3f4bd716f5b018e26085f10d38c42fd0f6e07891438d13ccc5b36f38ab9c7f1ea874814ed266f8551a970c8ca3eb73ac6b4950

    Score
    3/10
    behavioral5behavioral6

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks