Extracted

• • Target

    documents.lnk

  • Size

    2KB

  • MD5

    73a8d2488fda1347130de9f0efec4f6b

  • SHA1

    e5bc7521dbfe149fa8f6df6a0ce5e5d99223a3d0

  • SHA256

    2254ed69e23e3f357b4283a055d0841d77c298c30052113b8e4a841d5b5b66ab

  • SHA512

    d2003816e2e8114e4c5f8aec410c6694d733b818d63d66b4a1d8bd78bf25eba8cb5f3f260efee8709322031475796e9ef7a835928fbdb27a9c6cb8fbe6e97130

  Score

  10^/10

  icedid1044021123bankerloadersuricatatrojan

  • IcedID, BokBot

    IcedID is a banking trojan capable of stealing credentials.

    trojanbankericedid

  • suricata: ET MALWARE Win32/IcedID Request Cookie

    suricata: ET MALWARE Win32/IcedID Request Cookie

    suricata

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  behavioral1behavioral2

• • Target

    hertbe.dll

  • Size

    812KB

  • MD5

    d03775865c90131c3e57f535594347e9

  • SHA1

    31bbcce546094c4f225d1c6fa699ab1a6f4d9687

  • SHA256

    bae7251096be5fc53cc6e893c7c951933b0bdd6e6e16e77612c06cc742032ace

  • SHA512

    af9bae2a23da371e76b5b4930a06bbbafe673642af5021c6adbd7b1dc4e4c40ef4fccfcf91ec797c95b6e083a6c712dfb8e781dddaeea693d4f59ec3a974a0f4

  Score

  10^/10

  icedid1044021123bankerloadersuricatatrojan

  • IcedID, BokBot

    IcedID is a banking trojan capable of stealing credentials.

    trojanbankericedid

  • suricata: ET MALWARE Win32/IcedID Request Cookie

    suricata: ET MALWARE Win32/IcedID Request Cookie

    suricata

  • Blocklisted process makes network request

  behavioral3behavioral4