Overview

overview

10

Static

static

LoanStatus...df.lnk

windows7-x64

3

LoanStatus...df.lnk

windows10-2004-x64

3

here/AmO7Koa.cmd

windows7-x64

1

here/AmO7Koa.cmd

windows10-2004-x64

1

here/aSR0li1t.js

windows7-x64

1

here/aSR0li1t.js

windows10-2004-x64

1

here/qIfRtTz.dll

windows7-x64

10

here/qIfRtTz.dll

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    unpaid_loan_sample_20220725.zip
  • Size 228KB
  • Sample220725-tkmsxadde6
  • SHA256 b96220c1055bd0baa99252aa1778abb90dacdfa16ce0cd5d45f3f0a51ecedf9a
  • MD5 SHA1 SHA512
Score
10/10
icedid801015007bankerloadertrojan

Malware Config

Extracted

Family

  • icedid

Campaign

  • 801015007

C2

  • eventbloodd.com

Targets

    • Target
      LoanStatus_07_25_22pdf.lnk
    • Size 1KB
    • SHA256 9a5566c191c6d076ff9ff3312420f4f5361a5ff9c38dc66b88897c0de7736e6e
    • MD5 SHA1 SHA512
    Score
    3/10
    behavioral1behavioral2
    • Target
      here/AmO7Koa.cmd
    • Size 34B
    • SHA256 b6f81bb60fc210287913010d20b271e570383d8651f53471937148e03f7ec647
    • MD5 SHA1 SHA512
    Score
    1/10
    behavioral3behavioral4
    • Target
      here/aSR0li1t.js
    • Size 280B
    • SHA256 c9ea42248e98dd43fa5bcd1a90237420f1072b240edc716a75c72f1c3621d625
    • MD5 SHA1 SHA512
    Score
    1/10
    behavioral5behavioral6
    • Target
      here/qIfRtTz.dat
    • Size 326KB
    • SHA256 db32431f3df3693dbe9db49bbe07dfffc9c92ac5c2e33336d17b5d954854ed52
    • MD5 SHA1 SHA512
    Score
    10/10
    icedid801015007bankerloadertrojan

    • IcedID, BokBot

      IcedID is a banking trojan capable of stealing credentials.

      trojanbankericedid

    • Blocklisted process makes network request

    behavioral7behavioral8

MITRE ATT&CK Enterprise v6

Tasks