Overview

overview

10

Static

static

878.dll

windows7_x64

10

878.dll

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    878.dll

  • Size

    353KB

  • Sample

    220627-w4wk9scgcr

  • MD5

    986e75b5f349d6066edd3c4b5428b21c

  • SHA1

    909f7b67f329152299dd2c194e17bb71ad5ffa9e

  • SHA256

    42435ec9bb4f504231565acd20f873fe7800cc1219e724e116e11a5bf5db1bb6

  • SHA512

    3baa45314e2aa16b97fc5a377a23e9b6820b4b4c6bdd13a5006c5fc3e2f44c83acc774be29623f8f3457fe3562c3292386495f10183a9cc9d49e46a151120cd1

Score
10/10
icedid3239568078bankerloadersuricatatrojan

Malware Config

Extracted

Family

icedid

Campaign

3239568078

C2

carbrownleger.com

Targets

    • Target

      878.dll

    • Size

      353KB

    • MD5

      986e75b5f349d6066edd3c4b5428b21c

    • SHA1

      909f7b67f329152299dd2c194e17bb71ad5ffa9e

    • SHA256

      42435ec9bb4f504231565acd20f873fe7800cc1219e724e116e11a5bf5db1bb6

    • SHA512

      3baa45314e2aa16b97fc5a377a23e9b6820b4b4c6bdd13a5006c5fc3e2f44c83acc774be29623f8f3457fe3562c3292386495f10183a9cc9d49e46a151120cd1

    Score
    10/10
    icedid3239568078bankerloadersuricatatrojan

    • IcedID, BokBot

      IcedID is a banking trojan capable of stealing credentials.

      trojanbankericedid

    • suricata: ET MALWARE Win32/IcedID Request Cookie

      suricata: ET MALWARE Win32/IcedID Request Cookie

      suricata

    • Blocklisted process makes network request

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks