Extracted

• • Target

    ker3p/documents.lnk

  • Size

    2KB

  • MD5

    bb347ab4742d9c9b5cafe0aac6ab1316

  • SHA1

    6296df650baf990a47e8c97f7ca0e20fadff8962

  • SHA256

    1d34cb09006522f9c3f48858814fdf22a7bb698cd72b9302f8319f0cb3768a19

  • SHA512

    47cd1e449d80c9f7fe0f6b4c4d1da4db7a1453f3d738330cccee86884218496f78ff934d3c2d43978f75779d5ef3c635f2daee3894136f5abf5fec6797c1f6cc

  Score

  10^/10

  icedid3635541348bankerloadersuricatatrojan

  • IcedID, BokBot

    IcedID is a banking trojan capable of stealing credentials.

    trojanbankericedid

  • suricata: ET MALWARE Win32/IcedID Request Cookie

    suricata: ET MALWARE Win32/IcedID Request Cookie

    suricata

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  behavioral1behavioral2

• • Target

    ker3p/ker3p.dll

  • Size

    424KB

  • MD5

    c9955a4afdcca16c28107f274d816977

  • SHA1

    d0e1807614e7112c2fd06388ab4ba93a9134f29f

  • SHA256

    46786e3f05ec3271f4f71907aee0a8819d08b776f7e43e1ae4096ce22ec2f7d2

  • SHA512

    24e28f00b50595d5d624572a627fa787b7e8c6c4eefb4dded3fabe6148abaa11a8079d2ca2c8e8233b5f554d5983722e6a29adaf91eb90f592f0cd560e4f49f8

  Score

  10^/10

  icedid3635541348bankerloadersuricatatrojan

  • IcedID, BokBot

    IcedID is a banking trojan capable of stealing credentials.

    trojanbankericedid

  • suricata: ET MALWARE Win32/IcedID Request Cookie

    suricata: ET MALWARE Win32/IcedID Request Cookie

    suricata

  • Blocklisted process makes network request

  behavioral3behavioral4