General

  • Target

    fa6b3a4cdb30fc5d0a99231d426a88311fb36bf43e75cc9c0a2bf8869829e2f4

  • Size

    534KB

  • Sample

    220707-vq6zeaebd7

  • MD5

    7bc303db11754758b77e211402adb82d

  • SHA1

    6e8f44dad1935d050ed140a22fa00a388b295464

  • SHA256

    fa6b3a4cdb30fc5d0a99231d426a88311fb36bf43e75cc9c0a2bf8869829e2f4

  • SHA512

    edfe1c8eed7505bf6fa066cfcf4e835fa07a088169aa4b7476a06ed4670fd10a7b219f2d55e2ef3e4468b47e1ccc434500c0fbf5703466108825f88b3d803ce7

Malware Config

Extracted

Family

icedid

Campaign

227378761

C2

blionarywesta.com

Targets

    • Target

      fa6b3a4cdb30fc5d0a99231d426a88311fb36bf43e75cc9c0a2bf8869829e2f4

    • Size

      534KB

    • MD5

      7bc303db11754758b77e211402adb82d

    • SHA1

      6e8f44dad1935d050ed140a22fa00a388b295464

    • SHA256

      fa6b3a4cdb30fc5d0a99231d426a88311fb36bf43e75cc9c0a2bf8869829e2f4

    • SHA512

      edfe1c8eed7505bf6fa066cfcf4e835fa07a088169aa4b7476a06ed4670fd10a7b219f2d55e2ef3e4468b47e1ccc434500c0fbf5703466108825f88b3d803ce7

    • IcedID, BokBot

      IcedID is a banking trojan capable of stealing credentials.

    • suricata: ET MALWARE Win32/IcedID Request Cookie

      suricata: ET MALWARE Win32/IcedID Request Cookie

    • Blocklisted process makes network request

MITRE ATT&CK Matrix

Tasks