Overview

overview

10

Static

static

9TAzSK5f.dll

windows7_x64

10

9TAzSK5f.dll

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    9TAzSK5f.LnB

  • Size

    536KB

  • Sample

    220707-v5fe1aehe4

  • MD5

    0804193317e5caa22a799ef101dd8c3a

  • SHA1

    2f9286c5833ffbb9233e77512372f31b499d7d45

  • SHA256

    90e06ab57da0fdd785bca9eb0b2fa05027fe6e3498865e24c07f0366c92150e2

  • SHA512

    70917660d06cde3da25f7751b9aed0133e47165faa432f3a23f18e47ce8ba87c7ba9f576f64f669eb1bc3d1819a4bf2e4429e92667e5d6fef21a9d3f916208f0

Score
10/10
icedid227378761bankerloadersuricatatrojan

Malware Config

Extracted

Family

icedid

Campaign

227378761

C2

blionarywesta.com

Targets

    • Target

      9TAzSK5f.LnB

    • Size

      536KB

    • MD5

      0804193317e5caa22a799ef101dd8c3a

    • SHA1

      2f9286c5833ffbb9233e77512372f31b499d7d45

    • SHA256

      90e06ab57da0fdd785bca9eb0b2fa05027fe6e3498865e24c07f0366c92150e2

    • SHA512

      70917660d06cde3da25f7751b9aed0133e47165faa432f3a23f18e47ce8ba87c7ba9f576f64f669eb1bc3d1819a4bf2e4429e92667e5d6fef21a9d3f916208f0

    Score
    10/10
    icedid227378761bankerloadersuricatatrojan

    • IcedID, BokBot

      IcedID is a banking trojan capable of stealing credentials.

      trojanbankericedid

    • suricata: ET MALWARE Win32/IcedID Request Cookie

      suricata: ET MALWARE Win32/IcedID Request Cookie

      suricata

    • Blocklisted process makes network request

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks