Overview

overview

10

Static

static

p3roms.dll

windows7_x64

10

p3roms.dll

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    p3roms.dll

  • Size

    731KB

  • Sample

    220629-xag2fsbhhp

  • MD5

    cd544b0dd2c06aee8ae6453b945a379d

  • SHA1

    0f0c97334a38ade5f7c245b1c0ee9046b9b73609

  • SHA256

    431d800fb8243fef043f01f72aabd1e1c6e7ca7e690839aa59002cd9e03970b1

  • SHA512

    4e25ce3eaf0488c94b4fab81cc331d09d500c674c731062cef3749830e4a68b1d9666d26e8b3f333de30f202751a513113afdd127405a802cf4ace0dd5d635e6

Score
10/10
icedid3652318967bankerloadersuricatatrojan

Malware Config

Extracted

Family

icedid

Campaign

3652318967

C2

yankyhoni.com

Targets

    • Target

      p3roms.dll

    • Size

      731KB

    • MD5

      cd544b0dd2c06aee8ae6453b945a379d

    • SHA1

      0f0c97334a38ade5f7c245b1c0ee9046b9b73609

    • SHA256

      431d800fb8243fef043f01f72aabd1e1c6e7ca7e690839aa59002cd9e03970b1

    • SHA512

      4e25ce3eaf0488c94b4fab81cc331d09d500c674c731062cef3749830e4a68b1d9666d26e8b3f333de30f202751a513113afdd127405a802cf4ace0dd5d635e6

    Score
    10/10
    icedid3652318967bankerloadersuricatatrojan

    • IcedID, BokBot

      IcedID is a banking trojan capable of stealing credentials.

      trojanbankericedid

    • suricata: ET MALWARE Win32/IcedID Request Cookie

      suricata: ET MALWARE Win32/IcedID Request Cookie

      suricata

    • Blocklisted process makes network request

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks