Extracted

• • Target

    documents.lnk

  • Size

    2KB

  • MD5

    77e1106d0ee3c074c5aa94663e62ca8c

  • SHA1

    5149a36f2934cbe44a7066e96756d4ecb7a65cbd

  • SHA256

    4633c5e89c5c9e60c3609dfb7f5ca1f0794c2b84c3468cdc2129d942d4e09cf3

  • SHA512

    8644ef5ca3082bf4f062e53bdba5231f5b010c90fae919bb76f16dc46dae10a76e3ef94dca6d6ae709b4aaeb39b80eedbdc41298fc8d561e0561a51cde9575e6

  Score

  10^/10

  icedid3652318967bankerloadersuricatatrojan

  • IcedID, BokBot

    IcedID is a banking trojan capable of stealing credentials.

    trojanbankericedid

  • suricata: ET MALWARE Win32/IcedID Request Cookie

    suricata: ET MALWARE Win32/IcedID Request Cookie

    suricata

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  behavioral1behavioral2

• • Target

    s4pesa.dll

  • Size

    731KB

  • MD5

    aee5edbcfafb2c7a64ae6fece8de9e97

  • SHA1

    446dd83a84b7eb5aac762017396b0a7b8776b7a3

  • SHA256

    3576cdf797b23022feb4ec7eb4ff7b87d3a79a04574e35893efce871b0a7c92c

  • SHA512

    495320cc7a3ba699df1fd7e5f1df76d1a5debe1320246eb0e644d9692d7692d69aea9e3185cefbd9e54a68f2f9b4d0497f1a71a2b7d9aeb345369cc777859692

  Score

  10^/10

  icedid3652318967bankerloadersuricatatrojan

  • IcedID, BokBot

    IcedID is a banking trojan capable of stealing credentials.

    trojanbankericedid

  • suricata: ET MALWARE Win32/IcedID Request Cookie

    suricata: ET MALWARE Win32/IcedID Request Cookie

    suricata

  • Blocklisted process makes network request

  behavioral3behavioral4