General

  • Target

    default.png.dll

  • Size

    534KB

  • Sample

    220707-vwnp1sedf3

  • MD5

    a1bcfdb83a0ca2a70b67c20977fc8469

  • SHA1

    845a171abcca9ec8a4c58e8b9ffce78b31af42be

  • SHA256

    926210300a931253b0de69be61f4bdc881aad266c3d48d6b37c25d5b549ba3ae

  • SHA512

    08e4817ed5ae894ff94def35d2daa6505ab76195e9f77af6c3e795af05e06d58a4f6db355872856c6db71109c7a3c643626f21fd4132ffc01a4f2cacbdf3dc5a

Malware Config

Extracted

Family

icedid

Campaign

227378761

C2

blionarywesta.com

Targets

    • Target

      default.png.dll

    • Size

      534KB

    • MD5

      a1bcfdb83a0ca2a70b67c20977fc8469

    • SHA1

      845a171abcca9ec8a4c58e8b9ffce78b31af42be

    • SHA256

      926210300a931253b0de69be61f4bdc881aad266c3d48d6b37c25d5b549ba3ae

    • SHA512

      08e4817ed5ae894ff94def35d2daa6505ab76195e9f77af6c3e795af05e06d58a4f6db355872856c6db71109c7a3c643626f21fd4132ffc01a4f2cacbdf3dc5a

    • IcedID, BokBot

      IcedID is a banking trojan capable of stealing credentials.

    • suricata: ET MALWARE Win32/IcedID Request Cookie

      suricata: ET MALWARE Win32/IcedID Request Cookie

    • Blocklisted process makes network request

MITRE ATT&CK Matrix

Tasks