Extracted

• • Target

    r7kom.dll/documents.lnk

  • Size

    2KB

  • MD5

    ce783276c0618e3197fb2d3f51ae5790

  • SHA1

    f42e8af4f540c3e6b6a77a8b272f976fc7d44b1d

  • SHA256

    bb1fe6256cc9fc42bd74632871700af5f8663fe954a53378298b35c1f187f16b

  • SHA512

    99485a9f6a7ab134a162c3a7de48284d76f946d877ac718899ec5c54fc3b00f3cc26070742993fbb823f200c6bfb7ebf98ab83be5881a7595f297a6773a5f05f

  Score

  10^/10

  icedid3568430872bankerloadersuricatatrojan

  • IcedID, BokBot

    IcedID is a banking trojan capable of stealing credentials.

    trojanbankericedid

  • suricata: ET MALWARE Win32/IcedID Request Cookie

    suricata: ET MALWARE Win32/IcedID Request Cookie

    suricata

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  behavioral1behavioral2

• • Target

    r7kom.dll/r7kom.dll

  • Size

    450KB

  • MD5

    fdf40a208c17de2500e9a3a9aaccb5db

  • SHA1

    9e86a5c1e94e561da0ca51d505fc899fb2c27635

  • SHA256

    973bcb320032e9a12faee2971c15ec8c2c52dcf095699dc705a1d22118e58a18

  • SHA512

    bd5c76d1526788dd8c8bae4a6273595d0817e4e3e1d725a04e250549194624465ec65967390830e17bec5b7ef88ccb96e61474852b8f25e01e704f3964b91197

  Score

  10^/10

  icedid3568430872bankerloadersuricatatrojan

  • IcedID, BokBot

    IcedID is a banking trojan capable of stealing credentials.

    trojanbankericedid

  • suricata: ET MALWARE Win32/IcedID Request Cookie

    suricata: ET MALWARE Win32/IcedID Request Cookie

    suricata

  • Blocklisted process makes network request

  behavioral3behavioral4