Extracted

• • Target

    documents.lnk

  • Size

    2KB

  • MD5

    bb347ab4742d9c9b5cafe0aac6ab1316

  • SHA1

    6296df650baf990a47e8c97f7ca0e20fadff8962

  • SHA256

    1d34cb09006522f9c3f48858814fdf22a7bb698cd72b9302f8319f0cb3768a19

  • SHA512

    47cd1e449d80c9f7fe0f6b4c4d1da4db7a1453f3d738330cccee86884218496f78ff934d3c2d43978f75779d5ef3c635f2daee3894136f5abf5fec6797c1f6cc

  Score

  10^/10

  icedid3635541348bankerloadersuricatatrojan

  • IcedID, BokBot

    IcedID is a banking trojan capable of stealing credentials.

    trojanbankericedid

  • suricata: ET MALWARE Win32/IcedID Request Cookie

    suricata: ET MALWARE Win32/IcedID Request Cookie

    suricata

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  behavioral1behavioral2

• • Target

    ker3p.dll

  • Size

    424KB

  • MD5

    0d3a6e438f8d63ae7497d9bdb13bee3b

  • SHA1

    bd680e291b3b1083b39432a2334999c857d762e9

  • SHA256

    b1a4bc1dd5f4e7aedaadce81a76b6b75acdddc4a1049fa606de70d45aecc4739

  • SHA512

    46f28f939170c37b515f6514a57157598e3c9b469b3afcb3f3473d7c3cac5cddb793ca7c05cc5d67d99c997e22e183c457861bb4cf4236f45ab93613130f11bb

  Score

  10^/10

  icedid3635541348bankerloadersuricatatrojan

  • IcedID, BokBot

    IcedID is a banking trojan capable of stealing credentials.

    trojanbankericedid

  • suricata: ET MALWARE Win32/IcedID Request Cookie

    suricata: ET MALWARE Win32/IcedID Request Cookie

    suricata

  • Blocklisted process makes network request

  behavioral3behavioral4