General

  • Target

    878.dll

  • Size

    353KB

  • Sample

    220627-w5df3scgdj

  • MD5

    986e75b5f349d6066edd3c4b5428b21c

  • SHA1

    909f7b67f329152299dd2c194e17bb71ad5ffa9e

  • SHA256

    42435ec9bb4f504231565acd20f873fe7800cc1219e724e116e11a5bf5db1bb6

  • SHA512

    3baa45314e2aa16b97fc5a377a23e9b6820b4b4c6bdd13a5006c5fc3e2f44c83acc774be29623f8f3457fe3562c3292386495f10183a9cc9d49e46a151120cd1

Malware Config

Extracted

Family

icedid

Campaign

3239568078

C2

carbrownleger.com

Targets

    • Target

      878.dll

    • Size

      353KB

    • MD5

      986e75b5f349d6066edd3c4b5428b21c

    • SHA1

      909f7b67f329152299dd2c194e17bb71ad5ffa9e

    • SHA256

      42435ec9bb4f504231565acd20f873fe7800cc1219e724e116e11a5bf5db1bb6

    • SHA512

      3baa45314e2aa16b97fc5a377a23e9b6820b4b4c6bdd13a5006c5fc3e2f44c83acc774be29623f8f3457fe3562c3292386495f10183a9cc9d49e46a151120cd1

    • IcedID, BokBot

      IcedID is a banking trojan capable of stealing credentials.

    • suricata: ET MALWARE Win32/IcedID Request Cookie

      suricata: ET MALWARE Win32/IcedID Request Cookie

    • Blocklisted process makes network request

MITRE ATT&CK Matrix

Tasks