Extracted

Extracted

Extracted

• • Target

    Invoice.lnk

  • Size

    168KB

  • MD5

    edbd1edc29cbffb556ce1f114cce26b0

  • SHA1

    272d13aacab4f01bef6291bdc6cadfa1056d7487

  • SHA256

    6dedf3cf1241a2db9515459013693dc05dcb0538f99a99aa894a1cd822bac040

  • SHA512

    001efa270ffd6cdb9223a34749f9f6c840efa2a4cfe226ed12cf2941c13b94da3e7ae3e60189f6f89a1bb2c5756b3657335a8fad916e4bbb04cd616d11b4a2d6

  Score

  10^/10

  icedid1487191074bankerloadersuricatatrojan

  • IcedID, BokBot

    IcedID is a banking trojan capable of stealing credentials.

    trojanbankericedid

  • suricata: ET MALWARE Win32/IcedID Request Cookie

    suricata: ET MALWARE Win32/IcedID Request Cookie

    suricata

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  behavioral1behavioral2