Overview

overview

10

Static

static

s4pesa.dll

windows7_x64

10

s4pesa.dll

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    s4pesa.dll

  • Size

    731KB

  • Sample

    220629-21e21afea3

  • MD5

    aee5edbcfafb2c7a64ae6fece8de9e97

  • SHA1

    446dd83a84b7eb5aac762017396b0a7b8776b7a3

  • SHA256

    3576cdf797b23022feb4ec7eb4ff7b87d3a79a04574e35893efce871b0a7c92c

  • SHA512

    495320cc7a3ba699df1fd7e5f1df76d1a5debe1320246eb0e644d9692d7692d69aea9e3185cefbd9e54a68f2f9b4d0497f1a71a2b7d9aeb345369cc777859692

Score
10/10
icedid3652318967bankerloadersuricatatrojan

Malware Config

Extracted

Family

icedid

Campaign

3652318967

C2

yankyhoni.com

Targets

    • Target

      s4pesa.dll

    • Size

      731KB

    • MD5

      aee5edbcfafb2c7a64ae6fece8de9e97

    • SHA1

      446dd83a84b7eb5aac762017396b0a7b8776b7a3

    • SHA256

      3576cdf797b23022feb4ec7eb4ff7b87d3a79a04574e35893efce871b0a7c92c

    • SHA512

      495320cc7a3ba699df1fd7e5f1df76d1a5debe1320246eb0e644d9692d7692d69aea9e3185cefbd9e54a68f2f9b4d0497f1a71a2b7d9aeb345369cc777859692

    Score
    10/10
    icedid3652318967bankerloadersuricatatrojan

    • IcedID, BokBot

      IcedID is a banking trojan capable of stealing credentials.

      trojanbankericedid

    • suricata: ET MALWARE Win32/IcedID Request Cookie

      suricata: ET MALWARE Win32/IcedID Request Cookie

      suricata

    • Blocklisted process makes network request

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks