Extracted

• • Target

    ahol3m.dll

  • Size

    600KB

  • MD5

    bd9713be8ab4a1faf11241bb18faa20e

  • SHA1

    89cdc2142dd16e6026018483c686d028ea219deb

  • SHA256

    ce90e85553cb19c787de4421a8bb0bc89c2f3c942cbc41bba92b6bf822d815bf

  • SHA512

    7963f54c66435bc064953f81c59fa0bd3bc43fa22752df7cd5ef96404c41fa62672f2ea409273431930c840f35549ef557ffc33bed1fa354f7de158ee471ca3a

  Score

  1^/10
  behavioral1behavioral2

• • Target

    documents.lnk

  • Size

    2KB

  • MD5

    248322abe291aa979c34ee5f9bd76e70

  • SHA1

    fdfa1670324e951e44736b75b4c12d7aac1a4338

  • SHA256

    518a3f0b6e5709fcf44b04208167a51f77e4c82283f71b800a6faf297431f36c

  • SHA512

    a37819e37d2b93c2043c21339a81ddd7dcc43f933cad369313efe45fee9e51f51e30556455d1e720071f60596d298c594b789e4a1b4fdc104cc903df2c684805

  Score

  10^/10

  icedid1328647508bankerloadersuricatatrojan

  • IcedID, BokBot

    IcedID is a banking trojan capable of stealing credentials.

    trojanbankericedid

  • suricata: ET MALWARE Win32/IcedID Request Cookie

    suricata: ET MALWARE Win32/IcedID Request Cookie

    suricata

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  behavioral3behavioral4