Overview

overview

10

Static

static

cmd.bat

windows7_x64

1

cmd.bat

windows10-2004_x64

1

labor-.dll

windows7_x64

10

labor-.dll

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    core.zip

  • Size

    799KB

  • Sample

    220604-qf72hachfk

  • MD5

    b54f9a14ad80280e07e360f9de0c90cd

  • SHA1

    cc4a52a18968e9240755465a8aebe01642d845eb

  • SHA256

    b02d8fe1588d2cb30bb4e45a75fb5b24385185d066f013e53ee546a882c16c0e

  • SHA512

    cf9c295798d1b7fafdd4ac5c77938a5ea6ba98607281c140f57a5d98c271ecd40d3f492ca54370cdf2c1bd4278be945f44920d18092cbe88bb433bfe38d54bc2

Score
10/10
icedid3681413287bankercore_loadertrojan

Malware Config

Extracted

Family

icedid

Botnet

3681413287

C2

vadgeatemoz.com

akernilon.com

westdudil.com

leatyeals.com
Attributes
  • auth_var

    3

  • url_path

    /news/

Targets

    • Target

      cmd.bat

    • Size

      188B

    • MD5

      d67f758395e66ed03d9065d8c23f2894

    • SHA1

      1d635b99201ef4551132d29495e0c259404bd5eb

    • SHA256

      afc903fcce880470df94d38d1f877c114c16ba78d2a25a0b9094c99e425f3586

    • SHA512

      d48a6f81dc69bf0b9024e775c8620c504f1563e57978213635e3ebd546c450a3e8c621ba58d1dc1d1c2f71b4563ff8c7abd0915255874a59bfb4917c2cb2ff5f

    Score
    1/10
    behavioral1behavioral2

    • Target

      labor-.tmp

    • Size

      464KB

    • MD5

      6dff622395b320b2a1947480d697d3c0

    • SHA1

      b2d90b643749b06d6ae98e71205cab2e67bc1d56

    • SHA256

      82e07bd3ecada519802984139c213db4332bbc49b61509a6b40b7142c28f4900

    • SHA512

      59be37e0dfd5fef04763a51e449265a25176401a58b35b7b28016e99a6860437ed8985b0ffb14182eb8df2c61943a54a0bbab38466d67946ef652b5d107ded11

    Score
    10/10
    icedid3681413287bankercore_loadertrojan

    • IcedID, BokBot

      IcedID is a banking trojan capable of stealing credentials.

      trojanbankericedid
    behavioral3behavioral4

MITRE ATT&CK Matrix

Tasks