General

  • Target

    6bd1248ca9b95b5adeaf3ded016daf69.dll

  • Size

    675KB

  • Sample

    220710-pmkzwadhg5

  • MD5

    6bd1248ca9b95b5adeaf3ded016daf69

  • SHA1

    f8bd587215cee5152e076e642e85958c9ed0e003

  • SHA256

    45ccc6c4fb826261452264020c200e05a2ec4990fe8a5111fd8a777afdc9eaf1

  • SHA512

    bacd01bbac29cca26b896a62512a734546cf3ccb299ab9a1b5cfa9eb384729b4a6030d23443fb5bce2dd02572c8b6e63d600327b833a5478a80c37b8fb009d4d

Malware Config

Extracted

Family

icedid

Campaign

1060798742

C2

carismorth.com

Targets

    • Target

      6bd1248ca9b95b5adeaf3ded016daf69.dll

    • Size

      675KB

    • MD5

      6bd1248ca9b95b5adeaf3ded016daf69

    • SHA1

      f8bd587215cee5152e076e642e85958c9ed0e003

    • SHA256

      45ccc6c4fb826261452264020c200e05a2ec4990fe8a5111fd8a777afdc9eaf1

    • SHA512

      bacd01bbac29cca26b896a62512a734546cf3ccb299ab9a1b5cfa9eb384729b4a6030d23443fb5bce2dd02572c8b6e63d600327b833a5478a80c37b8fb009d4d

    • IcedID, BokBot

      IcedID is a banking trojan capable of stealing credentials.

    • suricata: ET MALWARE Win32/IcedID Request Cookie

      suricata: ET MALWARE Win32/IcedID Request Cookie

    • Blocklisted process makes network request

MITRE ATT&CK Matrix

Tasks