Extracted

• • Target

    documents.lnk

  • Size

    2KB

  • MD5

    77e1106d0ee3c074c5aa94663e62ca8c

  • SHA1

    5149a36f2934cbe44a7066e96756d4ecb7a65cbd

  • SHA256

    4633c5e89c5c9e60c3609dfb7f5ca1f0794c2b84c3468cdc2129d942d4e09cf3

  • SHA512

    8644ef5ca3082bf4f062e53bdba5231f5b010c90fae919bb76f16dc46dae10a76e3ef94dca6d6ae709b4aaeb39b80eedbdc41298fc8d561e0561a51cde9575e6

  Score

  10^/10

  icedid3652318967bankerloadersuricatatrojan

  • IcedID, BokBot

    IcedID is a banking trojan capable of stealing credentials.

    trojanbankericedid

  • suricata: ET MALWARE Win32/IcedID Request Cookie

    suricata: ET MALWARE Win32/IcedID Request Cookie

    suricata

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  behavioral1behavioral2

• • Target

    s4pesa.dll

  • Size

    731KB

  • MD5

    85385ece7406ae8b3628e3a27098ddb9

  • SHA1

    6d9e54eaf9048628303055faf01910932bb32b9d

  • SHA256

    e85bbe0699df2c1ed14d3c409d082b94a04a1839d4bd00ddcbc5cb64f9849ec1

  • SHA512

    feb4e639a0d6207b1ae57e9202b79542529b0b96e9965f48f6a2fd3080c1b08f340e1bf3b82bb3fc978810de0df202e07ab33c811647f5f533dac766ec37e17c

  Score

  10^/10

  icedid3652318967bankerloadersuricatatrojan

  • IcedID, BokBot

    IcedID is a banking trojan capable of stealing credentials.

    trojanbankericedid

  • suricata: ET MALWARE Win32/IcedID Request Cookie

    suricata: ET MALWARE Win32/IcedID Request Cookie

    suricata

  • Blocklisted process makes network request

  behavioral3behavioral4