Overview

overview

10

Static

static

98hd0.dll

windows7_x64

10

98hd0.dll

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    98hd0.dll

  • Size

    600KB

  • Sample

    220614-sfdh1abac4

  • MD5

    95a7228c8037415eea95e0d17e39215d

  • SHA1

    c97c25b17748725f0bd0548d4948b8b000082465

  • SHA256

    c3633dd0ea01015aa923cc81bf1cb6ff2a0c4c4cbf807d3c2098d492a559198d

  • SHA512

    e92c82b9cc3192ebe2185721fa7900afa3faf583438d3e11909a9f90d37678548e42ecdab73c31da9b360fd1438ea669c8677b36c290b9b141eb0ae19c632e1d

Score
10/10
icedid3139257902bankerloadersuricatatrojan

Malware Config

Extracted

Family

icedid

Campaign

3139257902

C2

blandafearz.com

Targets

    • Target

      98hd0.dll

    • Size

      600KB

    • MD5

      95a7228c8037415eea95e0d17e39215d

    • SHA1

      c97c25b17748725f0bd0548d4948b8b000082465

    • SHA256

      c3633dd0ea01015aa923cc81bf1cb6ff2a0c4c4cbf807d3c2098d492a559198d

    • SHA512

      e92c82b9cc3192ebe2185721fa7900afa3faf583438d3e11909a9f90d37678548e42ecdab73c31da9b360fd1438ea669c8677b36c290b9b141eb0ae19c632e1d

    Score
    10/10
    icedid3139257902bankerloadersuricatatrojan

    • IcedID, BokBot

      IcedID is a banking trojan capable of stealing credentials.

      trojanbankericedid

    • suricata: ET MALWARE Win32/IcedID Request Cookie

      suricata: ET MALWARE Win32/IcedID Request Cookie

      suricata

    • Blocklisted process makes network request

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks